Hot answers tagged

13

There seems to be some confusion about the capabilities of a collision attack. Two of the properties a cryptographic hash must have are collision resistance and preimage resistance. If a hash is collision resistant, it means that an attacker will be unable to find any two inputs that result in the same output. If a hash is preimage resistant, it means an ...


9

This very high end GPU cracker performs 200GH/s: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 That's 200 billion hashes per second (2e11 hashes/s). With a search space of 1e19 possible numbers, that means it will take ~500,000 seconds (about 1.5 years) to exhaustively search parameter space. Of course on average you'll find a match in ...


7

I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider the file content as random input (no attacks) Based on your note of "no attacks" it seems to me that you are asking: "What is the probability that a random change (e.g., bit flip during download) to a file will result in creating a new/different file with the ...


5

First of all, let's be clear: encryption (encipherment) and hashing are not the same thing. Hash functions convert an arbitrary-size input into a fixed-size output, which by necessity loses some data and is therefore not reversible. If there isn't any way to get back to the plain text - and there isn't, with a hash function; you might find something that ...


5

This is not a collision attack, but a preimage attack With a collision attack, the attacker has control over both inputs to the hash function, say x and y, and they want to find x and y such that x ≠ y but h(x) = h(y). With a first preimage attack, the attacker knows h(x) but not x, and they want to find y such that h(y) = h(x). Importantly, the attacker ...


3

The comments cover an important aspect about MD5 collisions, but I'll give a little more food for thought (and the math to back it up) as I think there is a little misunderstanding in this area, especially around pre-image attacks. is it possible to trick someone into running a malicious executable file instead of a real one provided by a website; ...


3

Is it possible to decode the md5 hash, and therefore learn which malicious website was using the back doors to my server? As for the (in)feasibilty to decode the md5 hash see for example here. In short: if it is simple you can brute force it, if it is complex it will be infeasible. But even if you would be able to decode the hash: it does not contain the ...


3

MD5 collision vulnerabilities exist and it's feasible to intentionally generate 2 files with identical MD5 sums. No SHA256 collisions are known, and unless a serious weakness exists in the algorithm, it's extremely unlikely one will be found. For verifying a file was not accidentally corrupted, MD5 is probably sufficient. If it's possible it was ...


3

You have basically created a custom hashing algorithm. If no one knows how your algorithm works and no one knows that it is trivially based on MD5, then it will be extremely difficult, if not impossible, to crack this hash. So, to answer your question directly about the hash, it is likely going to be uncracked without further knowledge. The only real ...


2

What you're proposing is almost completely pointless, and probably counterproductive overall. It will protect you against some automatic scans that just look for standard formats, but not against someone who takes a few minutes to look at your system. It won't increase security I'm aware of that, but I believe it can make cracking the hash much difficult. ...


2

MD5 creates an 128-bit hash, whereas SHA256 creates a 256-bit hash. You could say that SHA256 is "twice as secure" as MD5, but really the chance of a random collision is negligible with either. I would say MD5 provides sufficient integrity protection. There are attacks to create MD5 collisions on purpose, but the chance of finding a collision on accident ...


2

It is never zero, there is always a probability that there are many files that have the same hash value due to the pigeonhole principle and almost uniform distribution of the output of the cryptographic hash functions. This can be understand by the arbitrary input size of the hash function but fixed output size, like MD5 has 128-bit and SHA-1 has 160-bit ...


2

The key aspect of hash functions that make them so useful is that they are one-way - it is very easy to hash an input and produce an output, but very difficult to convert a given output into a valid input. In other words, (in most cases) the best way to figure out what input was used to generate a given output is to guess-and-check. The good news for you is ...


1

If the hashsum that the user compares against is coming from a trusted, non-malicious file, then no, it is not possible. People who say that theoretically, a manufactured hashsum collision is possible, forget that we don't need to have "any" hashsum collision (like with passwords), but that our hashsum collision needs to be a viable executable first, and ...


1

You've calculated the MD5 of the file itself, not of its password ('123'). According to its download page, the only hashes supported by Hash Suite are as follows (and ZIP files are not included): LM, NTLM, Raw-MD5, Raw-SHA1, Raw-SHA256, Raw-SHA512, DCC, DCC2, SSHA, MD5CRYPT, BCRYPT, WPA-PSK Compressed file formats are only supported for storing wordlists,...


1

If an attacker is able to extract hashes from a database, they might sign up with the service so their password, pass123, is put through the hashing algorithm and inserted in the database. This would allow them to try common hash functions and determine how the hash is being obscured: Database hash 32250170a0dca92dfafe46b853ec9624f336ca24 SHA1 (pass123) ...


1

I'm a bit surprised no one has mentioned length extension attacks yet. This doesn't seem to be vulnerable, but it also seems like it may have avoided being vulnerable purely by chance. While it doesn't immediately appear vulnerable to any attacks, it's also non-standard. If you want a "signature" (what you want is actually called a MAC), you should use an ...


1

MD5 is broken in the sense that it is possible to create two pieces of data with the same hash. However, you need to be able to modify both pieces of data. For example, you can create two images with the same MD5, by manipulating both images. Then if a user or system checks only the MD5 of the file, you can swap the images and the MD5 remains the same. In ...


1

It sounds like you might need to tap one of the other major feature sets of hashcat: rules. Rules are ways to express common transformations that people make against base words to "complexify" them (changing case, reversing them, leet-ifying them, etc.). To try a rules-based attack, see the ./rules/ subdirectory, and apply one or more rulesets using attack ...


1

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? Yes, except that multiple iterations can sometimes be parallelized. So while it takes the same computing time, it may take less wall clock time because more computers can be put to the task. The key derivation function PBKDF2 relies on this ...


1

If you exclude malice or other intentional/MD5 aware behaviour, MD5 is really is fine. There is of course a chance of accidental collision of MD5 and SHA256 the odds of the SHA256 are a lot lower. However for some context: the odds of an accidental collision on MD5 is far lower that the chances that the check flag get accidentally flipped by a comsic ray, ...


1

Both MD5 and SHA256 resist a preimage attack, nowadays. This means that it would be near to impossible for someone to replace the file with a different one with the same {MD5|SHA256} hash. However, you should note MD5 is a broken hash function.† Attacks will only increase (there was a theoretical attack 10 years ago with computational complexity of 2123.4‡...


1

try john --show then enter the hash file location eg john --show Desktop/hash1.txt or because you have run the same hash before john already has it saved in .pot file and will not run it again until it has been removed. At your own risk try running john and john rm .pot or rm john.pot then running the same hash again.


1

You might look at Knuth's Multiplicative Hash, which generates a reversible, random-esque mapping between integers within the hash table's bounds. For example, Optimus implements Knuth's algorithm in PHP for the sake of obfuscating sequential IDs. However, do not use this algorithm for security purposes. You can read in detail in his book, Art of Computer ...


1

Please, have a look at this TCP Stream capture to a Postgres server from a client application (C# with Npgsql connector): There, you can see the md5 hash from password, username and salt (look at the black little arrow). Now, let´s see how does it look when a secure connection is used (SSL/TLS): As you can see, when using a secure connection, the MD5 ...


1

Thomas Pornin's answer is great, but there is a further point. It is not just tradition and human readability in the output of a hash, there are places where it applies to the input. In RFC2069 on Digest Access Authentication, the hash output is re-hashed when concatenated with more data. But counterintuitively (to me) the representation of the hash used ...


Only top voted, non community-wiki answers of a minimum length are eligible