Questions tagged [sha256]
SHA-256 is a hashing algorithm.
170
questions
0
votes
2answers
69 views
Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?
I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
9
votes
4answers
3k views
SHA & MD5 Collisions for shorter strings
This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions.
However, is it still possible to have a collision if the string length is less than ...
2
votes
0answers
79 views
Should a user's password hash and salt be included when a user requests to download their data under privacy laws? [closed]
I have two related questions:
When trying to design for privacy laws that require giving a user access to their data, should we include their password hash and salt in the data we offer for download?
...
1
vote
3answers
159 views
OpenSSL: best way to get sha256 hash of two sha256 hashes
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to ...
0
votes
0answers
23 views
How to make Remmina or freerdp display matching Windows remote desktop certificate thumbprint in SHA1? Or Windows to display it in SHA256?
When using Remmina in Ubuntu connecting to Windows remote desktop, a message about a mismatch of certificates get displayed. However, Remmina is displaying it in SHA256 format. But when I look at ...
2
votes
2answers
89 views
Appropriate length and slow, unsalted cryptographic hash function for random codes?
Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet.
We generate a random code that ...
1
vote
1answer
90 views
How to confirm the last entry of a linked hash list
We use a linked hash list for data integrity.
Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block:
Simplified example:
...
{
id: "...
0
votes
3answers
138 views
Different SHA256 checksum of same version of ssh binary on different machines
I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums.
I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
0
votes
1answer
115 views
Challenge-Response authentication and SSL
I'm currently developing an Android Application that communicates with a server and needs the user to login.
The connection is secured with SSL and certificate pinning.
For user authentication I'm ...
0
votes
0answers
58 views
AES_GCM ciphers are not disabling using SHA256 or SHA384
I am trying to disable ciphers using jdk.tls.disabledAlgorithms.
I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256.
...
0
votes
1answer
105 views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
14
votes
13answers
9k views
Couldn't we create a string that produces the same hash as another string in SHA-256?
Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8.
If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
0
votes
1answer
259 views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
1
vote
2answers
2k views
Is it possible to brute-force the original message of SHA-256 given the size of original string?
Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
5
votes
2answers
234 views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
0
votes
1answer
155 views
Is HMAC-SHA256 more secure to hide information than SHA256?
I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
0
votes
1answer
367 views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
0
votes
1answer
172 views
Is signature based malware detection a thing of the past?
I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
0
votes
1answer
98 views
SHA256 hash can be used to decrypt data?
I have a backup script that encrypts everything using AES 256
Every day, I generate a random binary file as the password, and encrypt this random file with my public key.
Until now, I printed the ...
0
votes
1answer
2k views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
0
votes
1answer
116 views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
1
vote
1answer
216 views
Why does productsign use SHA1 instead of SHA256 to sign the pkg?
I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
0
votes
1answer
165 views
Are short messages hashed with a HMAC insecure?
Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key.
Would this person be able to derive any information about my secret key?...
0
votes
0answers
42 views
Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk
In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
5
votes
3answers
3k views
How can I find a SHA-256 hash with a given suffix using hashcat?
Recently we competed in the X-MAS 2019 CTF and many of the challenges included a proof of work (PoW) check to avoid Denial of Service (DoS) attacks against their servers. The most common was we were ...
1
vote
3answers
116 views
Using two salts - one stored with the password, one stored in a random row in a separate table
Imagine a login system is being created, and a user's password is hashed thusly:
Users.password = PBKDF2(salt1 + password + salt2)
The result of that ^ operation and salt1 are stored side-by-side in ...
0
votes
2answers
101 views
multiple call of gcry_md_write function
May be it 's not a question for information security stack exchange and if it's true excuse me for my mistake.
I want to understand how this code works:
char *s = "1";
char *s_2 = "2";
unsigned ...
0
votes
3answers
133 views
Can the username be used in HMAC during client-side hashing?
I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong.
My goal is to have the client side hash passwords before sending them to server side ...
0
votes
1answer
243 views
Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]
I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure.
I have legacy ...
1
vote
0answers
79 views
How to verify a binary correctly even if my github account is hacked by someone
I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases
To allow users to verify it, I saved sha256sum and signature(.asc).
However I have a concern that if ...
0
votes
0answers
732 views
Secure Http Connection With Authentication Header
I am trying to create an authentication header algorithm that can be used for authentication on HTTP server.
Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
3
votes
1answer
417 views
Crack 8-char password with known number of set bits
At University, I got some CTFs to do for my security lectures.
Basically, I need to crack an 8-character password (96 possible characters). I know that 42 of the 64 bits are set to 1 and I know the ...
1
vote
3answers
622 views
Which function to hash 128 bit API key with?
I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
0
votes
1answer
726 views
I need to compute a string whose SHA256 hash matches a given prefix. How should I approach it? [duplicate]
Is there any (more efficient) way for computing any string with a given prefix in it's SHA 256 hash? And how probable am I to stumble on such a string if I brute force?
9
votes
7answers
6k views
How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?
Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives.
I wonder how much safer is the use of the SHA256 hashes for integrity checks?
Note: Consider ...
0
votes
1answer
104 views
How are these transaction fingerprints colored?
For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
0
votes
3answers
518 views
Is it easier to calculate a partial SHA256 collision than a full one?
Question: Disregarding brute-force, is it any easier to calculate a partial hash collision, in which only a certain number of bits match?
Reasoning: On many websites you find hashes for file ...
1
vote
1answer
691 views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
0
votes
0answers
616 views
How to mask attack a sha256 hash with following information using hashcat?
I am hashcat newbie and I want to crack a hash :)
The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username)
How may I mask attack a hash with above ...
7
votes
2answers
7k views
Why is SHA-256 not good for passwords? [duplicate]
I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
1
vote
2answers
98 views
Confusion about the software and also the digital signature getting modified
I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
2
votes
1answer
485 views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
3
votes
1answer
12k views
How to decrypt a gpg file?
I have a gpg file and a sha256 file. When I try to decrypt the gpg file using the gpg - d file.gpg command, it says that there is no secret key. I am absolutely new to this so I would appreciate any ...
4
votes
1answer
1k views
when should i use HMAC-based JWT?
I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
-2
votes
1answer
146 views
SHA256 Encrypting with Value [closed]
Is it possible to encrypt a value (such as "hello world") with itself ("hello world") using an encrypting technique such as SHA256? Is that safe to do or would it be easily compromised?
0
votes
2answers
415 views
Sha256 hash + secret GUID + RNGCrypto random number to hash passwords
I'm maintaining a website which uses Sha256 hashing of passwords.
The passwords are hashed with a GUID key, and a RNGCrypto generated random salt.
I'm just trying to understand the security risks ...
0
votes
2answers
1k views
Generating salt for hash that occurs on server and client
Let's say I have an API call which is supposed to check if email address exists in the DB, without transmitting the actual email address.
For that purpose, I've decided to store SHA256 hash of the ...
3
votes
2answers
795 views
Can AES and SHA-256 outputs with the same inputs be used to break each other?
An abstract representation of my question looks like this:
byte[] encrypted = AES.Encrypt(bytesToEncrypt, password);
byte[] hash = SHA256.Hash(password);
If an attacker obtains the values of both ...
56
votes
5answers
15k views
Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?
I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
1
vote
3answers
327 views
Should Hashes of Sensitive Data be Encrypted
I'm planning on storing chunks of encrypted data inside a file, along with each chunk would be the hash(sha256) of the unencrypted chunk stored in the file as well. Is storing the hash secure?
