Difficulty of finding another input string that hashes to the same value as a given string

learn more… | top users | synonyms

11
votes
1answer
388 views

Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
10
votes
3answers
276 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or ...
9
votes
2answers
3k views

Pre-image resistant but not 2nd pre-image resistant?

Are there any cryptographic hash functions for which there is a known pre-image attack, or a known second pre-image attack, but not both? The attack doesn't have to be practical - just anything that ...
9
votes
1answer
2k views

Does collision resistance imply (or not) second-preimage resistance?

I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel: “Security ...
9
votes
1answer
2k views

Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
6
votes
1answer
124 views

Has there ever been more then a theoretical difference between preimage resistance and second preimage resistance?

In other words, has there ever been a point in time in which having the content of a message has actually helped break a hash function?
6
votes
1answer
1k views

Why doesn't preimage resistance imply the second preimage resistance?

Let the preimage resistance be defined as »given a hash value $h$, it is hard to find any message $m$ such that $\operatorname{hash}(m)=h$«, and let the second preimage resistance be defined as »given ...
5
votes
1answer
148 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
4
votes
1answer
2k views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = ...
4
votes
2answers
2k views

Why does second pre-image resistance imply pre-image resistance

I am studying hash functions. I can understand why collision resistance implies second preimage resistance, but I don't get why second preimage resistance should imply first preimage resistance. ...
4
votes
3answers
2k views

The difference between being not strongly collision resistant, and not weakly collision resistant?

So I understand the two concepts: (Strong) collision resistance: it is infeasible to find a pair $x \neq x'$ such that $h(x) = h(x')$ Weak collision resistance / 2nd-preimage resistance: for all $x ...
4
votes
1answer
99 views

Effect of message length on collision attacks

I know that message collisions are supposed to be hard to calculate for a good cryptographic hash. Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash. ...
3
votes
2answers
204 views

What, cryptographically speaking, is a “long message”?

I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message". Also, do long message attacks only apply ...
3
votes
1answer
255 views

Increased security weaknesses when truncating SHA1

Given the following preconditions: A plaintext A (~512bit length), that is hashed by using SHA-1 and truncated to (the first) 64 bits. I know both, the plaintext and the truncated hash, and want ...
2
votes
3answers
675 views

Computational feasible to reverse MD5SUM?

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size $N$ whose MD5SUM is $X$? For example, ...
2
votes
1answer
244 views

Is $H(x) = x^2 \bmod p$ pre-image resistant, second pre-image resistant and/or collision resistant

I have the function $H(x) = x^2\bmod p$ , where $p$ is a prime of length n bits and this function maps to the message $x$ to a n-bit hash value $H(x)$. I need to find out if it is pre-image ...
2
votes
2answers
733 views

Difference between collision resistance and target collision resistance

For a hash function, what's the difference between Collision Resistance and Target Collision Resistance?. I understand the definition of hash function collision resistance, but I don't know about ...
2
votes
1answer
156 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
2
votes
1answer
83 views

Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere. I think it should be 64 bits, but I'd feel safer if somebody who has ...
2
votes
0answers
489 views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
1
vote
1answer
164 views

Functions that are only second-preimage resistant?

Are there functions that satisfy the second-preimage resistance property without satisfying the others (preimage and collision resistance) ? I'm looking about such functions that compress data (exit ...
1
vote
1answer
86 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
1
vote
1answer
84 views

Near preimages, applicable to Bitcoin?

Bitcoin mining relies on generating a smaller hash than the so-called target (a function of the so-called difficultly), thus is vulnerable to a truncated preimage attack (you just need to obtain a ...
0
votes
1answer
60 views

What is the complexity to break second preimage resistance?

In the context an of hash functions we have three required properties. Preimage resistance Second preimage resistance Collision resistance. The bounds for Pre image collision is $O(2^{n-1})$, the ...
0
votes
1answer
79 views

Why Might XOR's Lead to Hash Functions Lacking 2nd Pre-image Resistance?

My hash function is as follows: Cut the string in half (assume even length of 2m) XOR's the two halves together Take the result of the XOR and pass it to a function (a one-to-one and "onto" ...
0
votes
1answer
21 views

Determining collision resistance of a function?

I am having trouble trying to understand if the function is collision resistant. As I understand it, preimage resistance means that it is hard for an adversary to find two messages that produce the ...