Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am considering the FNV1a 32 bit hash as part of a simple software security and authentication system. I am aware that FNV1a is NOT ideal but it may suit my needs.

I am aware that FNV1a has rather poor collision behavior, but I would like to know if it may be implemented in such a way as to minimize problems. Assuming pass-phrases are hashed in their entirety multiple inputs may have the same output, but what if each character of a pass-phrase is hashed and the hashes are concatenated in a string?

I suppose my questions is, is collision less likely for individual characters than for strings?

share|improve this question
1  
What goal do you want to achieve? Your character wise hashing is no better than ROT13 encryption. –  CodesInChaos Dec 9 '13 at 7:08
    
@CodesInChaos My purpose at the moment is just to learn and plan, so the flaws of such a scheme do mot matter very much for now. –  Daniel Dec 9 '13 at 19:05

1 Answer 1

up vote 1 down vote accepted

First of all, "Is collision less likely for individual characters than for strings?"

The answer to this is yes. In fact, experimentally verifying shows that for 8-bit ASCII characters the collision chance with FNV1a is 0. This is however not an impressive feat, seeing that the output is 4 times as large as the input.

However, using this you no longer have a hashing function in the traditional sense. Each character gets replaced by simple substitution table, and becomes 4 times as long.

As for security, this is useless. This is a simple unkeyed substitution cipher which can be broken by either statistical analysis within minutes, a good eyeball or even one chosen plaintext. This scheme doesn't follow Kerckhoffs's principle, which is also very bad.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.