WHAT IS HASH ALGORITHM?

The function that is used to map any data is known as a Hash Algorithms. The values which are being used in the hash function are known as hash values. It is based on public-key encryption. The data should be divided into different blocks for using hash algorithm values. The blocks should have a fixed size. The blocks which are used are known as data blocks.

There are different types of hash algorithms like Secure hash algorithms (SHA), Message digest (MD) algorithms, Whirlpool, RSA, RACE integrity Primitives evaluation message digest (RIPEMD). The process of hash algorithm functions for getting the final hash is known as “the avalanche effect”. The process will start from padding the message and gives the output with the final hash.

WHAT IS SHA-1?

SHA-1 is a part of Cryptography. SHA-1 stands for Secure Hash Algorithm 1. SHA-1 was first published in 1995. The designer of SHA-1 is the National Security Agency, United States. It is a hash cryptography function. The function of SHA-1 is taking input values and producing a 160-bit hash value. This is known as a message digest. Since 2005 SHA-1 is not considered for security purposes.

SHA-1 stop professionally in 2011. SHA-1 is used while entering a password on the login page of any website. This is the method of securing the information on your website. You will not be able to see the working of the SHA-1 but it will work in background and secures your password details.

Applications of SHA-1

– It is used in cryptography. SHA-1 form is used in TLS and SSL protocols. It works as the hash algorithms by the US government which is used in the law department. The law department of the US government uses the application in cryptographic algorithms for protecting some of the information. Digital Signature Standard is the primary function of SHA-1

– SHA-1 is used in data integrity. It is used to identify that the data is changed or not because of accidental corruption.

WHAT IS SHA-2?

SHA-2 stands for Secure Hash Algorithm 2. This was first published in 2001. SHA-2 is developed by the National Security Agency (NSA). SHA-2 is the group of the cryptographic hash algorithm. SHA-2 includes 6 different functions. This is developed in the replacement of SHA-1. Some of the applications like TLS, SSL, PGP, SSH, etc., using SHA-2. This provides better security and protection than SHA-1.

You need to reissue the certificate for updating SHA-2 in your system. SHA-2 consists of different size hashes such as 224-, 256-, 384-, and 512-bit. The structures of different sizes of a hash are almost similar. SHA-224 and SHA-384 is the smaller version of SHA-256 and SHA-512. FIPS (Federal Information Processing Standard) is used to generate the initial values. US patent consists of SHA-2 under them. In the present time, it is the best security and encryption system.

WHAT IS SHA-256?

SHA-256 comes under the SHA-2 hash algorithm. SHA-256 was the successor of SHA-1 and now it is the part of SHA-2. It is a digitalize signature for the data set which secures and encrypts the information and data. The algorithm symbols should be perfectly written. Even if one symbol is changed the whole value of the hash algorithm is changed. This will save the original form of data. This is one of the strongest hash function algorithms until now.

Steps of hashing SHA-256

Pre-processing

– First step is to develop padding the message. We need to specify the padded message comes from the system.

– Second step is to write the message in blocks.

– Third step is the initiation of hash values.

DIFFERENCE BETWEEN SHA-1 & SHA-2 & SHA-256

As we have discussed above SHA-1 was established by the US government. It is MD5 in nature. In this, the message will be in 160-bit of the hash value. It shows a 40-digit long message. But currently, SHA-1 stops working due to security reasons. Since 2005 people do not belive in the security of SHA-1.

SHA-2 replaced SHA-1 which is also developed by the US government. SHA-2 is basically a family algorithm. It consists of 6 different hash functions. The hash values in SHA-2 are different that is 224, 256, 384 and 512.

Active Directory Certificate Services Overview

Active Directory Certificate Services (AD CS) allows workstations, servers, and applications to establish trust within an Active Directory forest without the cost of third-party certificates like TLS.

This post shows how to install and configure Active Directory Certificate Services on server 2019.

Before you install Active Directory Certificate…

SHA1 – Service de certificat et dépréciation.

Comme le précise Philippe BARTH dans son blog, la fin du SHA1 semble s’accélérer. La date du 01 juin de cette année est de plus en plus mise en avant.

(more…)

User authentication is a big, big deal. It seems like every other day there’s some data breach at an internet giant. 

I wanted to talk in this blog post a little bit about how password storage and authentication actually works on the Internet. It’s an interesting topic, and one that I didn’t know much about before starting at App Academy.

How Password Storage Actually Works

Most people think that when they log into their favorite website, it goes something like this:

They send the server their password

Server receives password and compares it to their recorded password

If it’s a match, the server lets you in

That’s not at all what happens on any remotely competent website. You might guess: are the passwords encrypted then maybe, and then later decrypted when you check the passwords? I used to think this, but that’s wrong as well.

The passwords are actually hashed. What does it mean for a password to be hashed? It means that it’s run through a one-way, irreversible filter which can turn any piece of data into a random-looking string. 

That’s essentially what a hash function is. For any input data, it produces a random-looking string. But two important points. 1) A good hashing function will never produce the same random string for two different inputs, and 2) it’ll produce completely different strings if the input is changed even slightly. So the hashed version of “password″ might be “aslmdp20824” and the hashed version of “passworD” might be “64t09u02g.”

Note: this is not a code. It’s not transforming each letter by shifting it a certain amount or anything like that. A code is reversible; by definition, if you know how a code works, you can decode it. A hashed password is irreversible. The output is effectively random. “password″ will always produce “aslmdp20824″ if you run it through this function, but there’s no realistic way to get from the hashed password back to the original.

This is important. In our database, we’re never actually storing any passwords, nor are we storing encrypted passwords (i.e., password “codes”). We’re storing hashed passwords. That means there’s no way to get from a hashed password back to the original password. 

So how do we check if the typed password matches the stored one? When someone sends our website their password, we hash the password they give us through that exact same hashing function, and then compare that output hash to the hash that we saved in our database. Remember, hash functions always produce the same output for the same input. So if those hashes match, we let them in. 

Their real password isn’t saved anywhere on the database, it’s simply used in the business logic of our app and then immediately discarded. And here’s why this matters:

Let’s say our database gets stolen.

A team of tireless Chinese hackers have exploited a vulnerability in our hardware and stolen a copy of our database. As we speak, they’re hard at work on trying to break the passwords of all of our users so that they can wreak havoc. 

In our mind’s eye, we imagine the moment when they finally crack our database encryption. There are “oohs” and “ahhs” (or their Chinese equivalent) as they crowd around a dimly-lit screen and stare at a giant table. A giant table of... hashed passwords.

What can they do with hashed passwords?

Not a lot. Remember, good hashing algorithms are computationally impossible to reverse. This means that if a team of hackers can’t go from a hashed password back to the original password, they’re forced to go the other way. They have to guess a password, hash it, and see if the hashed output matches with what’s in the database. With a good (i.e., computationally expensive) hashing algorithm, this will take them a lot of time, a lot of guesses, and hundreds of thousands of dollars in computing power to crack even a moderate number of passwords.

Or, at least, it should.

The problem is that it won’t. At least, not if that’s the only precaution we’ve taken. In fact, within minutes of opening our hashed database, this team of Chinese hackers will have already broken hundreds of passwords. Our security will have failed.

Why?

Rainbow Tables are why.

I thought we hashed all of our passwords? Well, we did. The problem is not with our hashing algorithms, but with our users. Most of our users’ passwords are among the most common passwords. Hundreds of them use passwords like “qwerty123″ or “12345678.″ In fact, 91% of users use passwords that are within the 1000 most common passwords, and 99.8% of users use ones within the 10,000 most common (source). 

Much like us, our users are incompetent and can’t be trusted to get anything right.

So here’s the thing: if these hackers know that many people use passwords like “qwerty123,” if they were smart, they and their hacker buddies would join forces and compute a table of the hashes of the most common passwords in advance. Then anytime anyone cracks a database, the hackers can just check for hash values that show up anywhere in this giant pre-computed table, and then they instantly know what commonly-used password is being used in that database.

But where would a rogue team of Chinese hackers find something as amazing as that? Answer: by Googling it. They’re available on the Internet for free, and are fairly well-maintained at that.  They’re known as rainbow tables, and they are the bane of poorly secured websites. And right now, that’s ours. If anyone stole our database, their rainbow tables would grind us into the dust.

Here’s where salting comes in.

Salting Passwords

Salting is simply taking an (ideally random) arbitrary string, and appending it to each password before running it through our hashing function. So let’s say that our simplistic salt is to generate a number based on the seconds hand of the clock when our user signs up (0 - 60). So if you sign up at 2:52:42 PM, your salt is 42. What we do is we add that 42 to your password, and then we run your (salt + password) through our hashing algorithm.

Remember, slightly different inputs create totally different outputs. That’s what saves us here. Your “42qwerty123″ will produce a completely different hash from “qwerty123.” And your dumb buddy who also uses “qwerty123″ will now be “16qwerty123,” which also produces a completely different hash. 

The salt is still stored in the database. So when our hackers get access to the database, won’t they see the salts and just break our passwords then?

No, because the rainbow table is what gave our hackers the ability to break a bunch of passwords. And on that rainbow table, they don’t have entries for “12qwerty123″ and “45qwerty123,” or all of the other permutations of all the other most popular passwords. (And of course, in a real database, we’d have a much more complex salt than a two-digit number.) 

So their rainbow tables are useless. They’re back to guessing passwords, adding them to the salt, and trying to hash them to see if it matches what’s saved in the database. So for each user, they’d take the salt, and go down the list of most common passwords, adding the salt to the password to try to see if it matches.

And then, even if they’re finally able to crack one, they have to do the same thing for every single password in the database, even if the users’ passwords were exactly the same.

This is what’s known in expert circles as “winning.”

And that, in a nutshell, is how modern password authentication works. TL;DR: People are dumb.

Hope you learned something!

OpenSSL 產生並簽出 SHA2 (SHA256) 的憑證

因為 Google Chrome 39 出來的關係，一些以前簽出來只包含 SHA-1 的 SSL certificate 因此導致了綠色 icon 變成黃色 icon，所以都要重簽一次產生 SHA-2 資訊。

有人說可以只要在簽名產生 crt 的部份做就好，不過這邊還是都提出來，並且給驗證的方式。

如果本來就已經有寫好 script，那麼只要在產生 csr 與簽名產生 crt 的步驟都加上 -sha256 就可以解決了。

這是產生 csr 的：(${HOST} 以及 subj 的內容自己代換)

openssl req -new -key ${HOST}.key -subj "/C=TW/ST=Taiwan/L=Taipei/O=MyOrganization/OU=MyUnit/CN=${HOST}" -sha256 -out ${HOST}.csr

而 csr 檢查的方式是：

opens…