A birthday attack is a cryptanalytic technique. Birthday attacks can be used to find collisions in a cryptographic hash function. For instance, suppose we have a hash function which, when supplied with a random input, returns one of $k$ equally likely values. By repeatedly evaluating the function on ...

learn more… | top users | synonyms

4
votes
1answer
121 views

Is finding collisions in a part-hash not often enough a bad problem?

My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at ...
0
votes
1answer
134 views

Why Merkle Tree doesn't suffer Birthday attack?

I am trying to understand why Merkle Tree doesn't suffer the birthday attack? Can you help me? Thank you!
3
votes
2answers
66 views

Probability approximation of no collisions

I am comparing the actual probability of no collisions to the probability approximation formula of no collisions from the Understanding Cryptography text. The approximation is as follows: ...
3
votes
1answer
119 views

Is it possible to reverse the birthday attack calculation?

I find that for every 100 password salts in our database, we only average 94.73 distinct salt values (averaged over a total of around 18 million). Is there a way to take that observation and calculate ...
1
vote
1answer
94 views

Birthday-attack calculation in planning password salting strategy

The book Cryptography Engineering by Fergusun, Schneier, Kohno section 2.7.1 explains Birthday Attacks: "In general, if an element can take on N different values, then you can expect the first ...
4
votes
1answer
210 views

Formula for the number of expected collisions

Say we have a hash function that produces $n$ bit outputs. From the birthday problem that after around $\sqrt{2^n}$ different inputs to the has function, we can expect a collision. Say instead that ...
5
votes
1answer
1k views

What are the differences between collision attack and birthday attack?

From my understanding both types of attack, collision and birthday, are based on the principle of two randomly/pseudo-randomly chosen plaintext to hash to the same value. I don't want to launch any ...
2
votes
1answer
1k views

Practical brute-force attack on 128 bit encryption

In brute-force attack calculations cryptographers say we should assume an attacker will find the key after $2^{(n/2)}$ tries. If n=128, then n/2=64. We know that this is practical (A 64 bit key is ...
0
votes
1answer
154 views

How much work is required to detect multiple collisions for a hash function?

Assume an ideal hash function of output size n bits, detecting one collision requires approximately 2^(n/2) evaluations of the ...
1
vote
1answer
143 views

N way collision of hashes

For a collision $H(A_1) = H(A_2)$, the number of queries is $T^{1/2}$ where $\log_2(T)$ is length of hash output. Then, what would be the number of queries requried to find an $n$-collision ($H(A_1) = ...
2
votes
1answer
708 views

CMAC vs HMAC security strength

From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same ...
0
votes
1answer
132 views

No Birthday Attack to TCR

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” , which compared TCR (Target Collision Resistant) and ACR (Any collision Resistant). It says we wish to stress ...
12
votes
1answer
2k views

Three-way hash collision

According to the birthday paradox we need approximately $O(|T|^{1/2})$ samples from the tag-space to find a collision for a hash function $h:K\times M \to T$. But how many samples are needed to find a ...
5
votes
3answers
614 views

Birthday Attack

I am reading the birthday attack in wikipedia. We consider the following experiment. From a set of $H$ values we choose $n$ values uniformly at random thereby allowing repetitions. Let $p(n; ...
10
votes
1answer
7k views

How does a birthday attack on a hashing algorithm work?

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about ...
10
votes
2answers
381 views

Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?

I can't get an intuitive understanding of why it's $2^{(\frac{n}{2})}$ and not $2^n$, where $n$ is the number of bits of which the key consists.
11
votes
1answer
1k views

Security of N bit HMAC

Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?