Skip to main content

Questions tagged [sha256]

SHA-256 is a hashing algorithm.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

What is the point of a gpg file alongside the hash of a Linux ISO download? [duplicate]

I use linux and tend to distro hop a lot. I've noticed often that the distributions offer that you verify the download with a sha256sum hash and a GPG key. My understanding is that a file, e.g. a ...
dbqp's user avatar
  • 1
0 votes
1 answer
353 views

JWT - Able to change signature and its still verified?

I just ran into something strange IMO. I created a RSA Key using nodejs cryptoutils to use with my JWT auth server. What I observer using jwt.io was the following: The last letter of the signature can ...
Gandalf1783's user avatar
1 vote
2 answers
215 views

Does a database with pre-calculated SHA256 values exist for Windows EXEs?

Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
Fabby's user avatar
  • 123
0 votes
1 answer
112 views

Implications of SHA256 implementation producing false / unexpected hashes

I found that one of our programs uses an sha256 implementation, that produces different hashes for same inputs, compared to standard libraries (in this case compared to node:crypto and Web Crypto API. ...
Jankapunkt's user avatar
-2 votes
1 answer
424 views

Is it possible to bruteforce SHA256? [duplicate]

SHA256, 64 characters using only 0-9 or lowercase a-f Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
San's user avatar
  • 1
0 votes
1 answer
585 views

Generating a SHA-256 hash from the Linux command line

I know the string "03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd" generates the SHA-256 hash 4c0b2d2f119a09b607cb273a745b2b0430d5192e0c4e536f932be5d1a6be5883 using https:...
Aviril Smith's user avatar
15 votes
6 answers
9k views

Is it possible to generate a file with a given sha256sum checksum?

Is it possible to generate a file with a given sha256sum checksum? That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
Amruth A's user avatar
  • 223
1 vote
0 answers
146 views

The hash of kali-linux-2022.4-raspberry-pi-arm64.img.xz changed after burning it into an sd card

I was burning an iso file into the sd card with pi imager and I doubled checked the hash before the burning and after and I got different results sha256sum kali-linux-2022.4-raspberry-pi-arm64.img.xz ...
kaliisohashchanged's user avatar
0 votes
1 answer
531 views

Generating AES 256 key from ECDH P-384

Is there anything wrong with hashing(with SHA256) the shared secret generated by ECDH that is 384 bits long and using that as the AES key? Is there a difference between that and, say, truncating the ...
Ognjen Bjeletic's user avatar
6 votes
5 answers
4k views

Are SHA-256 hashes of user emails guaranteed to be unique?

I'm working on a website that will require users to insert a valid email address, which will work as their unique user id. This email will not be used for communicating with the user, it is only ever ...
Tommy's user avatar
  • 533
0 votes
1 answer
894 views

Collision probability between truncating vs subsequencing of SHA256 hash to 128 bits?

I am taking a SHA256 hash output in hexadecimal (64 hex nibbles), subsequencing it by taking every other character to make it 32 hex nibbles or 128 bits, and formatting it into a UUID string. This isn'...
twentyfifthnight's user avatar
4 votes
1 answer
1k views

What is the math behind iterations in PBKDF2-SHA256 for lastpass users?

I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica. Lastpass has admitted ...
Sakib Arifin's user avatar
1 vote
1 answer
118 views

Microsoft Teams encryption verification

This link suggests that MS Teams calls are encrypted and can be verified by reading out the 20-digit security codes found on the endpoint computers. To protect against a man-in-the-middle attack ...
Watki02's user avatar
  • 163
3 votes
1 answer
3k views

BLAKE-3 vs SHA-256 security

As we can see on this page, BLAKE-3 is about 14 times faster than SHA-256. Is it as safe as SHA-256? I would like to use it for my passwords which are 32 cryptographically random bytes, because my API ...
Szyszka947's user avatar
1 vote
3 answers
480 views

SHA256 for hashing 32 cryptographicaly random bytes

I need to hash 32 cryptographically random bytes, but later the verification the value with hash must be very fast, so I decided to use SHA256. Is it a security issue if my passwords are 32 ...
Szyszka947's user avatar
25 votes
6 answers
9k views

Is a sha256 hash of a unix timestamp a strong password

I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
ThisGuyCantEven's user avatar
2 votes
2 answers
3k views

Is there a relationship between the size of RSA key and size of hash function?

I have seen that for RSA2K the hash function SHA-256 has been used. Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
TJ1's user avatar
  • 123
0 votes
1 answer
877 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
jojupiter's user avatar
11 votes
1 answer
4k views

Does 7-Zip really run multiple rounds of SHA-256 when key stretching?

Recently I was testing whether I could make 7-Zip archives more bruteforce-resistant. Both someone on Wikipedia and @kelalaka on this website make the following claim: The 7z format supports ...
d33tah's user avatar
  • 6,574
2 votes
3 answers
7k views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
Karan Nayyar's user avatar
0 votes
2 answers
309 views

What should we expect of the SHA256 of a file's webpage vs. the one we get once we download the file?

I want to know whether the SHA256 of a file changes from being available for download to once we downloaded to a device. For example, I got the URL https://dl.google.com/tag/s/appguid%3D%7B8A69D345-...
u20210512's user avatar
2 votes
3 answers
1k views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
Peter Dongan's user avatar
0 votes
0 answers
16 views

Identify hash pattern inside a string [duplicate]

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...
Michael's user avatar
0 votes
2 answers
1k views

How likely is a SHA256 hash to be brute forced on this conditions?

If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
Simon's user avatar
  • 11
0 votes
1 answer
281 views

How many bits of security does a hash as a verifier provide?

Let's say I have a binary string s, that is generated by a cryptographically secure random byte generator, and a hash function SHA-256. I am using the hash h=sha256(s) as a one-time password verifier ...
Gamer2015's user avatar
  • 727
0 votes
2 answers
298 views

Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?

I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
security beginner's user avatar
10 votes
4 answers
8k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
Seth Knorr's user avatar
2 votes
3 answers
1k views

OpenSSL: best way to get sha256 hash of two sha256 hashes

I have two sha256 hashes as hex strings HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730 now I want to ...
matthias_buehlmann's user avatar
3 votes
2 answers
272 views

Appropriate length and slow, unsalted cryptographic hash function for random codes?

Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet. We generate a random code that ...
Dario Seidl's user avatar
1 vote
1 answer
173 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
codeteq's user avatar
  • 111
0 votes
3 answers
1k views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
John Yu's user avatar
0 votes
1 answer
754 views

Challenge-Response authentication and SSL

I'm currently developing an Android Application that communicates with a server and needs the user to login. The connection is secured with SSL and certificate pinning. For user authentication I'm ...
Thunderbolt's user avatar
0 votes
0 answers
567 views

AES_GCM ciphers are not disabling using SHA256 or SHA384

I am trying to disable ciphers using jdk.tls.disabledAlgorithms. I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256. ...
Rajendra Chiripireddy's user avatar
0 votes
1 answer
471 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
Albert Renshaw's user avatar
14 votes
13 answers
10k views

Couldn't we create a string that produces the same hash as another string in SHA-256?

Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8. If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
xyper's user avatar
  • 173
3 votes
1 answer
7k views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
Ananda Sai A's user avatar
2 votes
2 answers
10k views

Is it possible to brute-force the original message of SHA-256 given the size of original string?

Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
Max's user avatar
  • 185
6 votes
2 answers
2k views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
Janne Mattila's user avatar
0 votes
1 answer
3k views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
Halloween1977's user avatar
0 votes
1 answer
1k views

JtR Password hash not recognized

I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them. ...
Kaiser2500's user avatar
1 vote
1 answer
1k views

Is signature based malware detection a thing of the past?

I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
Aravind A's user avatar
  • 157
0 votes
1 answer
429 views

SHA256 hash can be used to decrypt data?

I have a backup script that encrypts everything using AES 256 Every day, I generate a random binary file as the password, and encrypt this random file with my public key. Until now, I printed the ...
Javier Loureiro's user avatar
4 votes
1 answer
5k views

BCrypt vs PBKDF2-SHA256

I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
mFeinstein's user avatar
0 votes
1 answer
3k views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
Floating Sunfish's user avatar
1 vote
1 answer
580 views

Why does productsign use SHA1 instead of SHA256 to sign the pkg?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
Bemipefe's user avatar
  • 121
2 votes
1 answer
580 views

Are short messages hashed with a HMAC insecure?

Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key. Would this person be able to derive any information about my secret key?...
BobbyTables's user avatar
0 votes
0 answers
196 views

Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk

In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
Alex's user avatar
  • 205
5 votes
3 answers
6k views

How can I find a SHA-256 hash with a given suffix using hashcat?

Recently we competed in the X-MAS 2019 CTF and many of the challenges included a proof of work (PoW) check to avoid Denial of Service (DoS) attacks against their servers. The most common was we were ...
Kristopher Ives's user avatar
1 vote
3 answers
186 views

Using two salts - one stored with the password, one stored in a random row in a separate table

Imagine a login system is being created, and a user's password is hashed thusly: Users.password = PBKDF2(salt1 + password + salt2) The result of that ^ operation and salt1 are stored side-by-side in ...
Sasha's user avatar
  • 13
0 votes
2 answers
251 views

multiple call of gcry_md_write function

May be it 's not a question for information security stack exchange and if it's true excuse me for my mistake. I want to understand how this code works: char *s = "1"; char *s_2 = "2"; unsigned ...
MrSetplus's user avatar