Questions tagged [sha256]
SHA-256 is a hashing algorithm.
178
questions
1
vote
2
answers
44
views
Is there a relationship between the size of RSA key and size of hash function?
I have seen that for RSA2K the hash function SHA-256 has been used.
Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
- 113
0
votes
1
answer
52
views
Why REST APIs that do not use RSA encryption to secure API keys?
After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key.
The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
10
votes
1
answer
3k
views
Does 7-Zip really run multiple rounds of SHA-256 when key stretching?
Recently I was testing whether I could make 7-Zip archives more bruteforce-resistant. Both someone on Wikipedia and @kelalaka on this website make the following claim:
The 7z format supports ...
- 6,504
2
votes
3
answers
399
views
How can I extract salt from encoded base64 Salted SHA 256 hashed password
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
- 125
0
votes
1
answer
69
views
What should we expect of the SHA256 of a file's webpage vs. the one we get once we download the file?
I want to know whether the SHA256 of a file changes from being available for download to once we downloaded to a device.
For example, I got the URL https://dl.google.com/tag/s/appguid%3D%7B8A69D345-...
2
votes
3
answers
220
views
Can a SHA2 x509 cert thumbprint be spoofed/specified?
Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control.
Supposing someone was able to view the thumbprint of a cert ...
- 125
0
votes
0
answers
74
views
Correct implementation of a JWT signee
I tried implementing my own JWT logic, because I thought it would have some benefits for my use-case. Later I realized, that using the official JWT implementation is easier to use and more secure. But ...
- 1
0
votes
0
answers
11
views
Identify hash pattern inside a string [duplicate]
I believe that this question was answered already, though I couldn't find it.
I have several strings that include hash. Each string has hash and some random (or not) add-on.
How can I identify the ...
- 1
0
votes
2
answers
258
views
How likely is a SHA256 hash to be brute forced on this conditions?
If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
- 11
0
votes
1
answer
158
views
How many bits of security does a hash as a verifier provide?
Let's say I have a binary string s, that is generated by a cryptographically secure random byte generator, and a hash function SHA-256.
I am using the hash h=sha256(s) as a one-time password verifier ...
- 695
0
votes
2
answers
144
views
Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?
I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
10
votes
4
answers
5k
views
SHA & MD5 Collisions for shorter strings
This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions.
However, is it still possible to have a collision if the string length is less than ...
- 109
1
vote
3
answers
648
views
OpenSSL: best way to get sha256 hash of two sha256 hashes
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to ...
3
votes
2
answers
155
views
Appropriate length and slow, unsalted cryptographic hash function for random codes?
Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet.
We generate a random code that ...
- 269
1
vote
1
answer
132
views
How to confirm the last entry of a linked hash list
We use a linked hash list for data integrity.
Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block:
Simplified example:
...
{
id: "...
- 111
0
votes
3
answers
506
views
Different SHA256 checksum of same version of ssh binary on different machines
I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums.
I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
- 1
0
votes
1
answer
364
views
Challenge-Response authentication and SSL
I'm currently developing an Android Application that communicates with a server and needs the user to login.
The connection is secured with SSL and certificate pinning.
For user authentication I'm ...
0
votes
0
answers
172
views
AES_GCM ciphers are not disabling using SHA256 or SHA384
I am trying to disable ciphers using jdk.tls.disabledAlgorithms.
I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256.
...
0
votes
1
answer
250
views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
- 103
14
votes
13
answers
9k
views
Couldn't we create a string that produces the same hash as another string in SHA-256?
Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8.
If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
- 173
2
votes
1
answer
2k
views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
- 23
1
vote
2
answers
5k
views
Is it possible to brute-force the original message of SHA-256 given the size of original string?
Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
- 75
5
votes
2
answers
760
views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
- 153
0
votes
1
answer
886
views
Is HMAC-SHA256 more secure to hide information than SHA256?
I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
0
votes
1
answer
753
views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
- 11
0
votes
1
answer
462
views
Is signature based malware detection a thing of the past?
I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
- 147
0
votes
1
answer
209
views
SHA256 hash can be used to decrypt data?
I have a backup script that encrypts everything using AES 256
Every day, I generate a random binary file as the password, and encrypt this random file with my public key.
Until now, I printed the ...
- 101
0
votes
1
answer
3k
views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
- 231
0
votes
1
answer
525
views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
- 169
1
vote
1
answer
348
views
Why does productsign use SHA1 instead of SHA256 to sign the pkg?
I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
- 131
1
vote
1
answer
293
views
Are short messages hashed with a HMAC insecure?
Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key.
Would this person be able to derive any information about my secret key?...
- 113
0
votes
0
answers
94
views
Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk
In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
- 185
5
votes
3
answers
5k
views
How can I find a SHA-256 hash with a given suffix using hashcat?
Recently we competed in the X-MAS 2019 CTF and many of the challenges included a proof of work (PoW) check to avoid Denial of Service (DoS) attacks against their servers. The most common was we were ...
- 161
1
vote
3
answers
154
views
Using two salts - one stored with the password, one stored in a random row in a separate table
Imagine a login system is being created, and a user's password is hashed thusly:
Users.password = PBKDF2(salt1 + password + salt2)
The result of that ^ operation and salt1 are stored side-by-side in ...
- 13
0
votes
2
answers
169
views
multiple call of gcry_md_write function
May be it 's not a question for information security stack exchange and if it's true excuse me for my mistake.
I want to understand how this code works:
char *s = "1";
char *s_2 = "2";
unsigned ...
- 41
0
votes
3
answers
269
views
Can the username be used in HMAC during client-side hashing?
I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong.
My goal is to have the client side hash passwords before sending them to server side ...
- 63
0
votes
1
answer
354
views
Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]
I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure.
I have legacy ...
1
vote
0
answers
123
views
How to verify a binary correctly even if my github account is hacked by someone
I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases
To allow users to verify it, I saved sha256sum and signature(.asc).
However I have a concern that if ...
- 185
0
votes
0
answers
921
views
Secure Http Connection With Authentication Header
I am trying to create an authentication header algorithm that can be used for authentication on HTTP server.
Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
- 101
3
votes
1
answer
576
views
Crack 8-char password with known number of set bits
At University, I got some CTFs to do for my security lectures.
Basically, I need to crack an 8-character password (96 possible characters). I know that 42 of the 64 bits are set to 1 and I know the ...
- 133
1
vote
3
answers
1k
views
Which function to hash 128 bit API key with?
I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
- 259
0
votes
1
answer
1k
views
I need to compute a string whose SHA256 hash matches a given prefix. How should I approach it? [duplicate]
Is there any (more efficient) way for computing any string with a given prefix in it's SHA 256 hash? And how probable am I to stumble on such a string if I brute force?
- 103
9
votes
7
answers
10k
views
How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?
Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives.
I wonder how much safer is the use of the SHA256 hashes for integrity checks?
Note: Consider ...
- 3,512
0
votes
1
answer
151
views
How are these transaction fingerprints colored?
For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
- 131
0
votes
3
answers
798
views
Is it easier to calculate a partial SHA256 collision than a full one?
Question: Disregarding brute-force, is it any easier to calculate a partial hash collision, in which only a certain number of bits match?
Reasoning: On many websites you find hashes for file ...
- 307
2
votes
1
answer
1k
views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
- 165
1
vote
0
answers
766
views
How to mask attack a sha256 hash with following information using hashcat?
I am hashcat newbie and I want to crack a hash :)
The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username)
How may I mask attack a hash with above ...
user189730
10
votes
2
answers
10k
views
Why is SHA-256 not good for passwords? [duplicate]
I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
- 211
1
vote
2
answers
181
views
Confusion about the software and also the digital signature getting modified
I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
- 257
2
votes
1
answer
749
views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
- 123