Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

For one of my university projects I am being asked to "Improve the code to satisfy the pre-image resistance requirement."

Basically the program is a basic encryption server system, and when I type a message like "dave is cool" the output is the same as if I were to put "cool is dave".

To get past this problem I have read that salt may be the answer but I am unsure of how to implement it.

I was hoping that someone on here could show me how?

Thanks, here is the code...

private int doHash(String input) {
    // Pad the String with spaces so that it is a multiple of 4 characters
    // long
    int padLength = input.length() % 4;
    if (padLength > 0) {
        for (int i = padLength; i < 4; i++) {
            input = input + " ";
        }
    }
    byte[] bInput = input.getBytes();
    // XOR each consecutive 4 byte block
    int hash = 0x00;
    int thisBlockAsInt = 0;
    for (int i = 0; i < bInput.length; i += 4) {
        System.out.println("i = " + i + "length = " + bInput.length);
        for (int n = i; n < i + 4; n++) {
            thisBlockAsInt <<= 8;     // Shift left 8
            thisBlockAsInt |= (int) bInput[n] & 0xFF;   //"add" the next byte
        }
        System.out.println("Block " + (i / 4 + 1) + " equals " +
                Integer.toHexString(thisBlockAsInt));
        hash = hash ^ thisBlockAsInt;
        System.out.println("Iteration " + (i / 4 + 1) + " hash equals " +
                Integer.toHexString(hash));
    }
    return hash;
}
share|improve this question

closed as off-topic by e-sushi, Gilles, rath, figlesquidge, AFS Mar 9 at 1:43

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Is this homework? If it is, you might want to recheck the requirements; true "pre-image resistance" (in the cryptographical sense) is actually fairly difficult (and unless you copy a primitive designed by someone else, it is seriously more advanced than where you are right now). And, no, salt does not particularly help with preimage resistance. –  poncho Mar 7 at 15:44
3  
As stated, this is a programming question, which is off-topic here. However, you could edit this to be about cryptography proper: explain the algorithm in the code, and ask how it fails to have preimage resistance (if you don't understand why) or how the algorithm could be modified to achieve this. –  Gilles Mar 7 at 21:47

1 Answer 1

Simply put, you need to first understand why that code is bad.
You also need to know what preimage resistance is.
The comments tell you the algorithm, you don't even need to read the code.

// Pad the String with spaces so that it is a multiple of 4 characters
// XOR each consecutive 4 byte block

This is not cryptographically secure, or even secure from a non cryptographic perspective. It is also why those 2 strings result in the same output

A salt will most likely be of no help, but in order to understand why, you need to understand the design criteria of a cryptographic hash algorithm, as well as a key derivation function.

I assume the exercise does not want you to simply substitute their algorithm with SHA-1 or something, but rather improve it so it is harder to work backwards than it currently is. You should start by studying the design of SHA-1 as well as some non cryptographic hash functions, such as hashCode used in Java programming. This should give you insight as to how they implement their compression functions as to eliminate the duplicate output problem, as well as protect the input from being reverse engineered.

I would also take Giles' advice on rephrasing the question to be more about the cryptographic aspects of the exercise.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.