Hot answers tagged

110

Just to cite wikipedia: http://en.wikipedia.org/wiki/SHA-2: The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. So yes, SHA-2 is a range of hash functions and includes SHA-256.


93

The size of the input is irrelevant. In fact, because of the birthday paradox, collisions are guaranteed as soon as the size of the message exceeds that of the hash. The best way to avoid collisions is to use a stronger hash which is not vulnerable to them, such as SHA-2. However, you are describing a more difficult attack than a collision attack, called a ...


73

Your premise has a flaw. You say you want to 'reverse engineer' the hash function. There's no need to reverse engineer it - its implementation is public. What you can't do is invert it (perhaps that's what you meant), because it's not invertible. You can easily tell it's not an invertible function because the size of the domain (possible number of inputs) is ...


57

I suppose you "use sha1sum" in the following context: you distribute some software packages, and you want users to be able to check that what they downloaded is the correct package, down to the last bit. This assumes that you have a way to convey the hash value (computed with SHA-1) in an "unalterable" way (e.g. as part of a Web page which is served over ...


48

I've added my answer here as I feel the existing ones don't directly address your question enough for my liking. Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you intend to use - em mine): Block size: the size of the data block the underlying hash algorithm operates upon. For SHA-256, this is 512 bits, for ...


39

Your string has an unintended line break at the end. Use -n to omit the trailing newline character: echo -n 'testpassword' | sha256sum > mypassword Otherwise you end up with a different hash: $ echo testpassword | sha256sum e0d7d338cb1259086d775c964fba50b2a84244ba4cd2815e9f6f4a8d9daaa656 - $ echo -n testpassword | sha256sum ...


35

Many cryptographic algorithms (hash functions, symmetric encryption...) are organized as a sequence of "rounds", which are more or less similar to each other. It was empirically noticed that for a given algorithm structure, usually, more rounds imply more security; precisely, some classes of attacks (e.g. differential and linear cryptanalysis) see their ...


35

Short answer: collisions don't matter for password verification. The length of the input is irrelevant. I understand that md5 and sha512, etc... are insecure because they can have collisions. No, this is wrong. MD5 and SHA-1 are insecure because it is possible in practice to find collisions. SHA-512 and the other SHA2 variants (SHA-256, SHA-384, etc.) have ...


31

The SHA-2 family consists of multiple closely related hash functions. It is essentially a single algorithm in which a few minor parameters are different among the variants. The initial spec covered four variants with output sizes of 224, 256, 384 and 512 bits. The most significant difference between the variants is that some are designed for 32 bit ...


29

General-purpose hashes have been obsolete for passwords for over a decade. The issue is that they're fast, and passwords have low entropy, meaning brute-force is very easy with any general-purpose hash. You need to use a function which is deliberately slow, like PBKDF2, bcrypt, or scrypt. Crackstation actually explains this if you read the whole page. On the ...


28

Asymmetric Cryptography There are two different parts to creating a TLS session. There is the asymmetric cryptography, portion which is an exchange of public keys between two points. Which is what you saw in your Alice and Bob example. This only allows the exchange of asymmetric keys for asymmetric encryption/decryption. This is the ECDHE portion. The ...


24

And it is longer than the input string, with 288bit instead of 256bit. So did we actually increased the entropy? No, you did not increase the entropy. In this context, "entropy" basically refers to the probability of any particular guess about the content or value being correct. If I tell you that I have hashed a single lowercase US English letter's ASCII ...


21

TLDR; SHA256 is good enough To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place; Why do we salt? To protect users that have weak password entropy from having their password cracked (e.g. rainbow tables or two users with the same password). This is not an issue because UUID4 will have 122 bits of ...


20

Though SHA-256 nominally offers a 256-bit output, no weakness about it is known when the output is truncated to 128 bits, except, of course, weaknesses inherent to the shorter output length; e.g. collision resistance drops from the infeasible 2128 to the possible (but hard) 264. This is not a generic property of hash functions(*), but it is somewhat "...


20

As @cpast says, the main problem of a single SHA-256 is that it is way too fast. An attacker with an off-the-shelf gaming GPU can try passwords at a rate that is counted in billions per second (American billions, but that's still a lot). Another problem is that there is potential for combining things improperly. SHA-256 is a hash function: it takes one ...


20

According to RFC 7518 - JSON Web Algorithms (JWA): A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This requirement is based on Section 5.3.4 (Security Effect of the HMAC Key) of NIST SP 800-117 (sic) [NIST.800-107], which states that the effective security strength is ...


20

You are mixing the attacks on the hash functions. The formal definition of generic attacks on cryptographic hash functions can be found at Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance by P. Rogaway and T. Shrimpton. Simply can be given as; The Pre-...


17

Don't do it. Salts have to be unique, that's their only requirement. But your approach doesn't generate unique salts, but password-dependent ones. A per-db-unique salt helps when its long enough (256 bits), and you also hash in the username, but that still leaves issues. Having only 3 iterations of SHA256 is rather not the way password hashes should be, ...


17

The technical answer is actually "no, because SHA-256 with RSA-2048 Encryption is not a certificate hashing algorithm. However, SHA-256 is a perfectly good secure hashing algorithm and quite suitable for use on certificates, and 2048-bit RSA is a good signing algorithm (signing is not the same as encrypting). Using 2048-bit RSA with SHA-256 is a secure ...


17

This is an awesome idea - to manually trace through the cert validation process! I've enjoyed reading through your steps, since I've never actually done it myself! Answering your questions: First question: Is this the correct way of obtaining the certificate the *.wikipedia.org certificate was signed with? After all, how can I be sure ẁikipedia.org didn'...


17

For password storage, salted SHA256 hashes are not recommended. This is because the general purpose SHA256 is designed to be fast. Fast is exactly what you do not want for a password hashing algorithm, because it makes brute force and dictionary attacks far more efficient. Password storage hashes are designed to require a certain workload and in some ...


16

It's all about reducing the overall risk of loss. A good hash algorithm makes it impossible to reverse the hash value to compute the original text. However, passwords are very, very short. By making a guess at a password, the attacker can compare the output of his SHA-256 against the SHA-256 that he finds in the database. And because passwords are so ...


15

You are doing a conversion from hex encoding (or base16 if you like) to base64. So you are base64 encoding the ASCII characters 9 (57), B (66) and 2 (50) giving you OUIy. What you should be doing is base64 encoding the raw bytes. So you should encode 0x9B (155) and 0x23 (35) giving you myM.


14

Ability to compute a lot of hashes very fast with dedicated hardware is a problem for password hashes, but not a new problem. Before the advent of ASIC specialized in SHA-256, we were already taking FPGA into account (see for instance this research machine, from already five years ago). An ASIC can roughly be clocked at two to three times the frequency of ...


14

To expand on the point that @cthulhu makes in his comment, the correct answer to this is "nether". SHA2 family hashing algorithms are not designed for password storage and unless you have no choice but to use a general purpose hashing algorithm, they should not be used. To quote this answer the main reasons for this are A basic hash function, ...


14

There seems to be some confusion about the capabilities of a collision attack. Two of the properties a cryptographic hash must have are collision resistance and preimage resistance. If a hash is collision resistant, it means that an attacker will be unable to find any two inputs that result in the same output. If a hash is preimage resistant, it means an ...


12

First, there is a difference between hashing and encryption. SHA256 is a hashing function, not an encryption function. Secondly, since SHA256 is not an encryption function, it cannot be decrypted. What you mean is probably reversing it. In that case, SHA256 cannot be reversed because it's a one-way function. Reversing it would cause a preimage attack, which ...


12

It depends on what you want to defend yourself against Security is never a one-size-fits-all game. If it were, then there would not be 12941 different hash algorithms. Instead, you need to understand that every security measure defends you against a specific sort of attack. You put a password in your computer to defend against random people accessing it, not ...


11

sha256 is not designed to hash passwords. To hash passwords, you should prefer to use hash functions created for this usage. You will find all required information below in another question addressing a similar request: Most secure password hash algorithm(s)?. In the above mentioned question, you will learn why general purpose hash functions like sha256 do ...


Only top voted, non community-wiki answers of a minimum length are eligible