Questions tagged [sha256]
SHA-256 is a hashing algorithm.
192
questions
0
votes
1
answer
89
views
JWT - Able to change signature and its still verified?
I just ran into something strange IMO.
I created a RSA Key using nodejs cryptoutils to use with my JWT auth server.
What I observer using jwt.io was the following:
The last letter of the signature can ...
- 15
1
vote
2
answers
141
views
Does a database with pre-calculated SHA256 values exist for Windows EXEs?
Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
- 123
0
votes
1
answer
50
views
Implications of SHA256 implementation producing false / unexpected hashes
I found that one of our programs uses an sha256 implementation, that produces different hashes for same inputs, compared to standard libraries (in this case compared to node:crypto and Web Crypto API.
...
- 135
-2
votes
1
answer
157
views
Is it possible to bruteforce SHA256? [duplicate]
SHA256, 64 characters using only 0-9 or lowercase a-f
Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
- 1
0
votes
1
answer
258
views
Generating a SHA-256 hash from the Linux command line
I know the string "03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd" generates the SHA-256 hash 4c0b2d2f119a09b607cb273a745b2b0430d5192e0c4e536f932be5d1a6be5883 using https:...
14
votes
6
answers
8k
views
Is it possible to generate a file with a given sha256sum checksum?
Is it possible to generate a file with a given sha256sum checksum?
That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
- 213
1
vote
0
answers
81
views
The hash of kali-linux-2022.4-raspberry-pi-arm64.img.xz changed after burning it into an sd card
I was burning an iso file into the sd card with pi imager and I doubled checked the hash before the burning and after and I got different results
sha256sum kali-linux-2022.4-raspberry-pi-arm64.img.xz
...
0
votes
1
answer
345
views
Generating AES 256 key from ECDH P-384
Is there anything wrong with hashing(with SHA256) the shared secret generated by ECDH that is 384 bits long and using that as the AES key? Is there a difference between that and, say, truncating the ...
5
votes
5
answers
2k
views
Are SHA-256 hashes of user emails guaranteed to be unique?
I'm working on a website that will require users to insert a valid email address, which will work as their unique user id. This email will not be used for communicating with the user, it is only ever ...
- 533
0
votes
1
answer
450
views
Collision probability between truncating vs subsequencing of SHA256 hash to 128 bits?
I am taking a SHA256 hash output in hexadecimal (64 hex nibbles), subsequencing it by taking every other character to make it 32 hex nibbles or 128 bits, and formatting it into a UUID string.
This isn'...
4
votes
1
answer
1k
views
What is the math behind iterations in PBKDF2-SHA256 for lastpass users?
I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica.
Lastpass has admitted ...
- 143
1
vote
1
answer
70
views
Microsoft Teams encryption verification
This link suggests that MS Teams calls are encrypted and can be verified by reading out the 20-digit security codes found on the endpoint computers.
To protect against a man-in-the-middle attack ...
- 163
2
votes
1
answer
2k
views
BLAKE-3 vs SHA-256 security
As we can see on this page, BLAKE-3 is about 14 times faster than SHA-256. Is it as safe as SHA-256? I would like to use it for my passwords which are 32 cryptographically random bytes, because my API ...
- 309
1
vote
3
answers
251
views
SHA256 for hashing 32 cryptographicaly random bytes
I need to hash 32 cryptographically random bytes, but later the verification the value with hash must be very fast, so I decided to use SHA256. Is it a security issue if my passwords are 32 ...
- 309
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
- 497
1
vote
2
answers
2k
views
Is there a relationship between the size of RSA key and size of hash function?
I have seen that for RSA2K the hash function SHA-256 has been used.
Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
- 113
0
votes
1
answer
661
views
Why REST APIs that do not use RSA encryption to secure API keys?
After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key.
The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
10
votes
1
answer
4k
views
Does 7-Zip really run multiple rounds of SHA-256 when key stretching?
Recently I was testing whether I could make 7-Zip archives more bruteforce-resistant. Both someone on Wikipedia and @kelalaka on this website make the following claim:
The 7z format supports ...
- 6,534
2
votes
3
answers
6k
views
How can I extract salt from encoded base64 Salted SHA 256 hashed password
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
- 125
0
votes
2
answers
218
views
What should we expect of the SHA256 of a file's webpage vs. the one we get once we download the file?
I want to know whether the SHA256 of a file changes from being available for download to once we downloaded to a device.
For example, I got the URL https://dl.google.com/tag/s/appguid%3D%7B8A69D345-...
2
votes
3
answers
867
views
Can a SHA2 x509 cert thumbprint be spoofed/specified?
Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control.
Supposing someone was able to view the thumbprint of a cert ...
- 125
0
votes
0
answers
15
views
Identify hash pattern inside a string [duplicate]
I believe that this question was answered already, though I couldn't find it.
I have several strings that include hash. Each string has hash and some random (or not) add-on.
How can I identify the ...
- 1
0
votes
2
answers
976
views
How likely is a SHA256 hash to be brute forced on this conditions?
If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
- 11
0
votes
1
answer
246
views
How many bits of security does a hash as a verifier provide?
Let's say I have a binary string s, that is generated by a cryptographically secure random byte generator, and a hash function SHA-256.
I am using the hash h=sha256(s) as a one-time password verifier ...
- 717
0
votes
2
answers
262
views
Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?
I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
10
votes
4
answers
7k
views
SHA & MD5 Collisions for shorter strings
This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions.
However, is it still possible to have a collision if the string length is less than ...
- 109
2
votes
3
answers
1k
views
OpenSSL: best way to get sha256 hash of two sha256 hashes
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to ...
3
votes
2
answers
234
views
Appropriate length and slow, unsalted cryptographic hash function for random codes?
Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet.
We generate a random code that ...
- 299
1
vote
1
answer
146
views
How to confirm the last entry of a linked hash list
We use a linked hash list for data integrity.
Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block:
Simplified example:
...
{
id: "...
- 111
0
votes
3
answers
1k
views
Different SHA256 checksum of same version of ssh binary on different machines
I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums.
I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
- 1
0
votes
1
answer
653
views
Challenge-Response authentication and SSL
I'm currently developing an Android Application that communicates with a server and needs the user to login.
The connection is secured with SSL and certificate pinning.
For user authentication I'm ...
0
votes
0
answers
419
views
AES_GCM ciphers are not disabling using SHA256 or SHA384
I am trying to disable ciphers using jdk.tls.disabledAlgorithms.
I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256.
...
0
votes
1
answer
385
views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
- 103
14
votes
13
answers
10k
views
Couldn't we create a string that produces the same hash as another string in SHA-256?
Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8.
If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
- 173
2
votes
1
answer
5k
views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
- 23
2
votes
2
answers
9k
views
Is it possible to brute-force the original message of SHA-256 given the size of original string?
Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
- 185
5
votes
2
answers
2k
views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
- 195
0
votes
1
answer
2k
views
Is HMAC-SHA256 more secure to hide information than SHA256?
I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
0
votes
1
answer
1k
views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
- 11
0
votes
1
answer
904
views
Is signature based malware detection a thing of the past?
I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
- 147
0
votes
1
answer
347
views
SHA256 hash can be used to decrypt data?
I have a backup script that encrypts everything using AES 256
Every day, I generate a random binary file as the password, and encrypt this random file with my public key.
Until now, I printed the ...
- 101
3
votes
1
answer
5k
views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
- 291
0
votes
1
answer
2k
views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
- 159
1
vote
1
answer
510
views
Why does productsign use SHA1 instead of SHA256 to sign the pkg?
I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
- 121
2
votes
1
answer
475
views
Are short messages hashed with a HMAC insecure?
Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key.
Would this person be able to derive any information about my secret key?...
- 123
0
votes
0
answers
153
views
Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk
In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
- 185
5
votes
3
answers
6k
views
How can I find a SHA-256 hash with a given suffix using hashcat?
Recently we competed in the X-MAS 2019 CTF and many of the challenges included a proof of work (PoW) check to avoid Denial of Service (DoS) attacks against their servers. The most common was we were ...
- 161
1
vote
3
answers
162
views
Using two salts - one stored with the password, one stored in a random row in a separate table
Imagine a login system is being created, and a user's password is hashed thusly:
Users.password = PBKDF2(salt1 + password + salt2)
The result of that ^ operation and salt1 are stored side-by-side in ...
- 13
0
votes
2
answers
216
views
multiple call of gcry_md_write function
May be it 's not a question for information security stack exchange and if it's true excuse me for my mistake.
I want to understand how this code works:
char *s = "1";
char *s_2 = "2";
unsigned ...
- 41
0
votes
3
answers
391
views
Can the username be used in HMAC during client-side hashing?
I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong.
My goal is to have the client side hash passwords before sending them to server side ...
- 83