Difficulty of finding two different inputs that hash to the same value

learn more… | top users | synonyms (1)

10
votes
3answers
204 views
+200

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or ...
7
votes
1answer
339 views

Why is EdDSA collision-resilient with SHA-512?

In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
5
votes
1answer
50 views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
0
votes
1answer
33 views

What is the run-time on finding collisions with MACs,…?

I've recently read the claim that finding collisions on block cipher may be not a difficult task, if an attacker can control the key and the message. So, given a pseudo-random function $f:\{0,1\}^m ...
0
votes
1answer
35 views

Collision Probability of MD5 over different attacks

I am researching on collision probability of MD5 on various attacks against it. Can someone help me with finding what is the least probability that there will be collision in specific attack on MD5 ? ...
5
votes
0answers
107 views

Is there any practical attack to create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work? Or to rephrase my last question: what are the ...
1
vote
1answer
167 views

Problem with testing MD5 collisions

I am trying to test MD5 collisions presented in “Collisions for Hash Functions MD4, MD5, HAVA” (PDF) by Xiaoyun Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu; 2004. I wrote a PHP script to test it, but ...
2
votes
1answer
64 views

Ideas for non duplicate cryptographically secure numbers

My Boss asked me this today. I am not a math major. He needs to generate 50 billion non-sequential non-duplicate (no collisions) cryptographically secure random numbers. I work in GO. Any ideas?
2
votes
3answers
90 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
3
votes
1answer
568 views

bcrypt - collision-resistance against chosen salt and work factor?

Would it be difficult to find $\:$ cost,salt,input,password0,password1 $\:$ such that bcrypt(cost,salt,password0,input) = bcrypt(workfactor,salt,password1,input) and $\:$ password0 != password1 $\:$ ...
2
votes
2answers
310 views

Why is HMAC-SHA1 still considered secure?

This Q & A http://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
3
votes
2answers
570 views

Proofs of collision resistance by reduction

I'm looking for examples of a proof by reduction. For example: Let $A=(Gen, H)$ be a hash function. We define a new Hash function $A'=(Gen',H')$ with $Gen=Gen'$ by $H'_s(x)=H_s(H_s(x))$. It ...
1
vote
0answers
27 views

Determine safety of exercise hash functions

There have been several attacks against hash functions such as $h_{sha1}$ and $h_{md5}$. Professor A suggests a new function $h_{666}$ with an output length of 666 bits. Professor B suggests ...
2
votes
1answer
95 views

Hash “Preimage by product” resistance

Let H() be a hash function that achieves collision resistance as well as first and second preimage resistance. Let's equip the output set of H of a multiplicative group structure, more precisely a ...
5
votes
1answer
493 views

What are the differences between collision attack and birthday attack?

From my understanding both types of attack, collision and birthday, are based on the principle of two randomly/pseudo-randomly chosen plaintext to hash to the same value. I don't want to launch any ...
0
votes
1answer
53 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
6
votes
2answers
300 views

Is HMAC-MD5 still secure for commitment or other common uses?

MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
0
votes
1answer
77 views

Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?

I'm aware that MD5 is broken, and collisions have been found for it. I'm interested in other hashes (SHA-1, SHA-2, SHA-3) when truncated to the same digest size, i.e. 128 bits. The time complexity of ...
0
votes
3answers
71 views

Is the hash function defined in this exercise collision-resistant?

I have this problem: "Let ${\rm Enc}_k(m)$ a safe block encryption system. We define a hash function $H(m)$ as follows: $m$ will be concatenated with $0$ until $|m|$ is a multiple of ...
0
votes
1answer
47 views

Which of the following hash functions is collision resistant?

Let $H: M \to T\ $ be a collision resistant hash function. Which of the following is collision resistant: $ 1.H'(m) = H(m \big\| m)$ $2.H'(m) = H(m) \big\| H(0)$ $3.H'(m) = H(m) \oplus H(m)$ ...
5
votes
4answers
4k views

Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function. My question is: do I have to deal with possible collisions ...
26
votes
6answers
20k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
0
votes
1answer
49 views

Why rogued certificate from hash collision is harmful

I cannot understand why rogued certificate is thought harmful though It can be used to impersonate some website. The attacker can craft a rogued certificate with different identities and public key ...
0
votes
1answer
59 views

Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?

By my math, if you are inputting all possible 17 byte values, and the output is 16 bytes long, then there must always be 256 possible inputs that will result in each output hashsum. However, looking ...
1
vote
1answer
79 views

Probability of SHA256 Collisions for Certain Amount of Hashed Values

I wonder if you can help me figure out that question: Is there a known probability function f: N -> [0,1], that computes the probability of a sha256 collision for a certain amount of values to be ...
1
vote
3answers
116 views

Cycles in SHA256

In the recommendations, it seems cycles is used usually as in "CPU Cycles", but, that's not what I mean here. What I mean, is this: Let's say I start with a particular 256 bit value. Call this v. I ...
1
vote
1answer
155 views

Concatenation of two strong hashes may have striking weakness

For any hash functions $H_0$ and $H_1$, it is easily proved that their concatenation $H_0\|H_1$, defined by $(H_0\|H_1)(X)=H_0(X)\|H_1(X)$, is at least as resistant as the strongest of $H_0$ and $H_1$ ...
0
votes
1answer
75 views

What practical uses can random hash collisions be put to?

Using magic, I've built a machine that instantly generates hash collisions. To try it out, I set the dial to SHA256 and typed in "e7cf3ef4f17c3999a94f2c6f612e8a888e5b1026878e4e19398b23bd38ec221a". I ...
0
votes
1answer
91 views

Reducing size of hash function

If I have some data I hash with SHA256 as hash=SHA256(data) and then copy only the first 8 bytes of the hash instead of the whole 32 bytes. How easy is it to find a ...
0
votes
1answer
65 views

Hashing - Digital Signing and Trivial Stretching

Two very basic questions: 1. Digital Signing Why is it not possible to just simply replace the hash value from the request? Examples: ...
4
votes
1answer
233 views

How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?

Given a cryptographic hash function $h$, for example SHA256, how hard is it to find plaintexts $a,b,c$ such that $$h(a)\oplus h(b)=h(c) \text?$$
0
votes
1answer
125 views

How much work is required to detect multiple collisions for a hash function?

Assume an ideal hash function of output size n bits, detecting one collision requires approximately 2^(n/2) evaluations of the ...
3
votes
2answers
338 views

Is double hashing collision resistant?

Double hashing can surely provide more security than only one layer of hashing but does that necessarily mean it is more collision resistant? This question in a more mathematical form: If $H$ is a ...
1
vote
2answers
184 views

Are there cryptographic hash functions which do not have any collisions?

I've been studying digital signatures and hash functions recently, and I was wondering: Do hash functions exist which will never produce collisions?
6
votes
2answers
2k views

Is there a hash function which has no collisions?

Is there a hash function which has no collisions? To clarify: it would be some function which would produce variable-length output, and never produce the same output for differing input. It would ...
3
votes
2answers
95 views

Security concern about reducing hash value using modulo operation

As stated in the title, what I am looking for is information about a "technique" that I would like to use in some of my algorithms. Sometimes I need to map a hash function's result into a range of ...
3
votes
1answer
601 views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = ...
2
votes
1answer
301 views

Finding a collision for a hash function

I'm trying to find a collision for the following (modified) Merkle–Damgård hash function. Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
2
votes
1answer
186 views

SHA-1 collision resistance

I'm researching on the SHA-1 algorithm and looking for reasons why it has fallen prey to differential cryptanalysis. I have read the research papers by Merc Stevens and Wang both of which describe how ...
1
vote
1answer
124 views

N way collision of hashes

For a collision $H(A_1) = H(A_2)$, the number of queries is $T^{1/2}$ where $\log_2(T)$ is length of hash output. Then, what would be the number of queries requried to find an $n$-collision ($H(A_1) = ...
3
votes
3answers
627 views

SHA1 Collisions - what about practical attacks?

I understand the theorical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of strucutred piece of ...
3
votes
2answers
208 views

Collision in Merkle–Damgård without a collision in compression function

Is it possible to find a collision in Merkle–Damgård just by omitting the extra one bit that is appended to each input without having a collision in compression function?
1
vote
1answer
220 views

Hash collision using the leading 40-bits of SHA-1

I am trying to implement Floyd's cycle finding algorithm for finding a leading 40-bit hash collision in the SHA-1 algorithm. However, my code will not find a repetition even with 800,000,000 hashes. ...
2
votes
3answers
213 views

Does this guarantee a unique 32 bit Hash?

I came across some source code that loosely does the below in order to achieve a 32 bit hash. The input string is passed through MD5 to get 16 bytes Hash (as usual). Then the 16 bytes are split into ...
-3
votes
2answers
1k views

finding collision for truncated SHA1 hash output

Suppose we truncate only 40 bits of sha1 hash output.hence it is insecure.how can we find two message as input which gives first 40 bits of hash as same value i.e we have to find collision for first ...
4
votes
3answers
1k views

The difference between being not strongly collision resistant, and not weakly collision resistant?

So I understand the two concepts: (Strong) collision resistance: it is infeasible to find a pair $x \neq x'$ such that $h(x) = h(x')$ Weak collision resistance / 2nd-preimage resistance: for all $x ...
0
votes
1answer
78 views
27
votes
1answer
7k views

No SHA-1 collision? Yet SHA-1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no than how can SHA-1 be considered broken?
6
votes
3answers
439 views

How many bits of hash are realistically needed for key verification?

Say I'm connecting to a web server secured with TLS but with a self-signed certificate. Accordingly, I call the owners of the server and ask them what SHA1 fingerprint they have. They start reading ...
2
votes
1answer
380 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...