Security

Is there a Splunk command to decrypt encrypted values under domain field?

VijaySrrie
Builder

Hi All,

I have encrypted the user field with sha256 

index=abc   sourcetype=xyz
| eval domain = sha256(User)
| table  domain

I am able to see encrypted values under domain field

Is there a splunk command to decrypt it?

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Encryption and hashing are different things - you are not "encrypting" data, you are just creating a hash of the data (User) 

https://en.wikipedia.org/wiki/Hash_function

For example, if you think that A=1, B=2 etc, then a "hash" of the word "HELLO" could be 52 (8+5+12+12+15)

But you cannot reverse 52 to make the word "HELLO" again - 52 could equally be ZZ or 52 letter A

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Encryption and hashing are different things - you are not "encrypting" data, you are just creating a hash of the data (User) 

https://en.wikipedia.org/wiki/Hash_function

For example, if you think that A=1, B=2 etc, then a "hash" of the word "HELLO" could be 52 (8+5+12+12+15)

But you cannot reverse 52 to make the word "HELLO" again - 52 could equally be ZZ or 52 letter A

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

sha256 is a hash function, meaning that you cannot "decrypt" the output.  It would have a profound impact in data security if anyone finds a way to reverse the output. (sha1 has been known to be insufficient for years but it wasn't until rather recently when Google managed to create a collision using their very powerful TPUs.  Even then, it wasn't to decrypt the hash value; the only attack mode to a hash function is hoping to find a string that will produce the same hash value.  There is no way to know whether the collision value is the original value.)

Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...