2022 Developer Survey is open! Take survey.

Questions tagged [sha256]

SHA-256 is a hashing algorithm.

Filter by
Sorted by
Tagged with
1 vote
2 answers
44 views

Is there a relationship between the size of RSA key and size of hash function?

I have seen that for RSA2K the hash function SHA-256 has been used. Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
user avatar
  • 113
0 votes
1 answer
52 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
user avatar
10 votes
1 answer
3k views

Does 7-Zip really run multiple rounds of SHA-256 when key stretching?

Recently I was testing whether I could make 7-Zip archives more bruteforce-resistant. Both someone on Wikipedia and @kelalaka on this website make the following claim: The 7z format supports ...
user avatar
  • 6,504
2 votes
3 answers
399 views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
user avatar
0 votes
1 answer
69 views

What should we expect of the SHA256 of a file's webpage vs. the one we get once we download the file?

I want to know whether the SHA256 of a file changes from being available for download to once we downloaded to a device. For example, I got the URL https://dl.google.com/tag/s/appguid%3D%7B8A69D345-...
user avatar
2 votes
3 answers
220 views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
user avatar
  • 125
0 votes
0 answers
74 views

Correct implementation of a JWT signee

I tried implementing my own JWT logic, because I thought it would have some benefits for my use-case. Later I realized, that using the official JWT implementation is easier to use and more secure. But ...
user avatar
  • 1
0 votes
0 answers
11 views

Identify hash pattern inside a string [duplicate]

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...
user avatar
0 votes
2 answers
258 views

How likely is a SHA256 hash to be brute forced on this conditions?

If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
user avatar
  • 11
0 votes
1 answer
158 views

How many bits of security does a hash as a verifier provide?

Let's say I have a binary string s, that is generated by a cryptographically secure random byte generator, and a hash function SHA-256. I am using the hash h=sha256(s) as a one-time password verifier ...
user avatar
  • 695
0 votes
2 answers
144 views

Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?

I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
user avatar
10 votes
4 answers
5k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
user avatar
1 vote
3 answers
648 views

OpenSSL: best way to get sha256 hash of two sha256 hashes

I have two sha256 hashes as hex strings HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730 now I want to ...
user avatar
3 votes
2 answers
155 views

Appropriate length and slow, unsalted cryptographic hash function for random codes?

Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet. We generate a random code that ...
user avatar
1 vote
1 answer
132 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
user avatar
  • 111
0 votes
3 answers
506 views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
user avatar
0 votes
1 answer
364 views

Challenge-Response authentication and SSL

I'm currently developing an Android Application that communicates with a server and needs the user to login. The connection is secured with SSL and certificate pinning. For user authentication I'm ...
user avatar
0 votes
0 answers
172 views

AES_GCM ciphers are not disabling using SHA256 or SHA384

I am trying to disable ciphers using jdk.tls.disabledAlgorithms. I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256. ...
user avatar
0 votes
1 answer
250 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
user avatar
14 votes
13 answers
9k views

Couldn't we create a string that produces the same hash as another string in SHA-256?

Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8. If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
user avatar
  • 173
2 votes
1 answer
2k views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
user avatar
1 vote
2 answers
5k views

Is it possible to brute-force the original message of SHA-256 given the size of original string?

Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
user avatar
  • 75
5 votes
2 answers
760 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
user avatar
0 votes
1 answer
886 views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
user avatar
0 votes
1 answer
753 views

JtR Password hash not recognized

I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them. ...
user avatar
0 votes
1 answer
462 views

Is signature based malware detection a thing of the past?

I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
user avatar
0 votes
1 answer
209 views

SHA256 hash can be used to decrypt data?

I have a backup script that encrypts everything using AES 256 Every day, I generate a random binary file as the password, and encrypt this random file with my public key. Until now, I printed the ...
user avatar
0 votes
1 answer
3k views

BCrypt vs PBKDF2-SHA256

I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
user avatar
0 votes
1 answer
525 views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
user avatar
1 vote
1 answer
348 views

Why does productsign use SHA1 instead of SHA256 to sign the pkg?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
user avatar
  • 131
1 vote
1 answer
293 views

Are short messages hashed with a HMAC insecure?

Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key. Would this person be able to derive any information about my secret key?...
user avatar
0 votes
0 answers
94 views

Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk

In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
user avatar
  • 185
5 votes
3 answers
5k views

How can I find a SHA-256 hash with a given suffix using hashcat?

Recently we competed in the X-MAS 2019 CTF and many of the challenges included a proof of work (PoW) check to avoid Denial of Service (DoS) attacks against their servers. The most common was we were ...
user avatar
1 vote
3 answers
154 views

Using two salts - one stored with the password, one stored in a random row in a separate table

Imagine a login system is being created, and a user's password is hashed thusly: Users.password = PBKDF2(salt1 + password + salt2) The result of that ^ operation and salt1 are stored side-by-side in ...
user avatar
  • 13
0 votes
2 answers
169 views

multiple call of gcry_md_write function

May be it 's not a question for information security stack exchange and if it's true excuse me for my mistake. I want to understand how this code works: char *s = "1"; char *s_2 = "2"; unsigned ...
user avatar
0 votes
3 answers
269 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
user avatar
0 votes
1 answer
354 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
user avatar
1 vote
0 answers
123 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
user avatar
  • 185
0 votes
0 answers
921 views

Secure Http Connection With Authentication Header

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server. Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
user avatar
  • 101
3 votes
1 answer
576 views

Crack 8-char password with known number of set bits

At University, I got some CTFs to do for my security lectures. Basically, I need to crack an 8-character password (96 possible characters). I know that 42 of the 64 bits are set to 1 and I know the ...
user avatar
  • 133
1 vote
3 answers
1k views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
user avatar
  • 259
0 votes
1 answer
1k views

I need to compute a string whose SHA256 hash matches a given prefix. How should I approach it? [duplicate]

Is there any (more efficient) way for computing any string with a given prefix in it's SHA 256 hash? And how probable am I to stumble on such a string if I brute force?
user avatar
  • 103
9 votes
7 answers
10k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
user avatar
  • 3,512
0 votes
1 answer
151 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
user avatar
0 votes
3 answers
798 views

Is it easier to calculate a partial SHA256 collision than a full one?

Question: Disregarding brute-force, is it any easier to calculate a partial hash collision, in which only a certain number of bits match? Reasoning: On many websites you find hashes for file ...
user avatar
  • 307
2 votes
1 answer
1k views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
user avatar
  • 165
1 vote
0 answers
766 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
user avatar
10 votes
2 answers
10k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
user avatar
  • 211
1 vote
2 answers
181 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
user avatar
2 votes
1 answer
749 views

Is it possible to tell if a file's message digest is MD5 or SHA-256?

There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
user avatar
  • 123