Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

New answers tagged

0 votes

Are all fields of the PE certificate directory hashed during authenticode signing?

Basically, if you want Python/pseudocode from folks who have reproduced the algorithm without using MSFT tools: raw_data = pe.__data__ hash_data = raw_data[:checksum_offset] + raw_data[...
user avatar
  • 111
0 votes

Hashing email addresses using scrypt

This can be an appropriate defense in depth measure if the secret is managed suitably. (A rather big “if”.) However, security is multidimensional. You say that you want to use the hashed email ...
user avatar
  • 954
0 votes

OpenSSH default/preferred ciphers, hash, etc for SSH2

2022's answer: By default, ssh uses 'chacha20-poly1305' cipher. $ man ssh_config [...] The supported ciphers are: 3des-cbc aes128-cbc ...
user avatar
0 votes

Why is the BCrypt text "OrpheanBeholderScryDoubt"

To discuss this more generally: Why was this string used? This type of string is a Nothing up my sleeves number (in reference to a magician about to show a trick). They are generally chosen to ...
user avatar
5 votes

Is this 36 character long string a hash

I found this string b2335332-d28f-449b-8d00-80a550b43046 Do you think it´s a hash? If yes any idea which one and if not any other ideas what it could be? It looks like a UUID. See, in particular, the ...
user avatar
  • 4,810
2 votes
Accepted

Good checksum algorithm for backup / cloud sync system

You need to consider what you need out of a hash function and what the consequences of a collision are. If a collision means that the file is not backed up when it should be, then the user will ...
user avatar
  • 6,705
2 votes
Accepted

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

These are often known as "magic hashes", and have been found for lots of different hashing algorithms. You can find a list of them here. The easiest way to find them to to look for a hash ...
user avatar
  • 3,571
2 votes

Argon2 vs SHA-512, what's better in my case?

The other answers have already explained why Argon2d is better than SHA512 for password hashing, but I'd like to share some experience on tuning Argon2 for web server. First, pick the Argon2 variant. ...
user avatar
11 votes

Argon2 vs SHA-512, what's better in my case?

Argon2 tuned to the max delay you can stand, if you must choose between the two - but the better answer may be: neither. Multiple judges for the Password Hashing Competition - that selected the Argon2 ...
user avatar
14 votes
Accepted

Argon2 vs SHA-512, what's better in my case?

Argon2 is intentionally slow: slow-hashing functions are good for storing passwords, because it is time/resource consuming to crack them. In the case of Argon2, the hashing consumes memory, too. The ...
user avatar
5 votes
Accepted

Potential problems with insecure password hashing

Wow, that was excruciating to read. The vendor should be deeply ashamed. Am I right in being concerned? Yes. That's phenomenally bad design. To make matters worse, there is simply no excuse ...
user avatar
  • 38.8k
2 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Checksums and signatures have different purposes. Checksums are good for verifying data integrity. They verify that you have received what you expected to receive. I would not recommend CRC32 or MD5 ...
user avatar
  • 759
3 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Checksums are typically easier to compute. If you're validating the signature on a given device anyways, that wont matter. But sometimes you may want to validate on one device and check for errors ...
user avatar
  • 9,206
8 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

It's not uncommon to have both. For example, developers of the Tails operating system sign their ISO's using GPG. See https://tails.boum.org/install/expert/index.en.html#verify for more info. But, ...
user avatar
  • 19.6k
20 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
user avatar
3 votes
Accepted

Is there a relationship between the size of RSA key and size of hash function?

There is no relation that matters between the size of the RSA key and the size of the hash. There is a technical constraint: a large hash can't be used with a small key. Depending on the signature ...
user avatar
2 votes

Is there a relationship between the size of RSA key and size of hash function?

Because the size of the modulus of an RSA key is substantially larger than most hash functions, it's possible to use most common hash functions with any RSA key of a secure size. For example, you ...
user avatar
  • 6,705

Top 50 recent answers are included