Difficulty of finding two different inputs that hash to the same value

learn more… | top users | synonyms (1)

15
votes
7answers
2k views

Is calculating a hash code for a large file in parallel less secure than doing it sequentially?

I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size. Normally, you sequentially hash the bytes of the files using a hash function (say, ...
5
votes
1answer
161 views

Does collision resistance imply (or not) second-preimage resistance?

I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel: “Security ...
1
vote
1answer
128 views

SHA1 collision event probability after n iterations

There are String1 and String2 - some variables-strings. The probability of collision for different ...
2
votes
2answers
100 views

Is a collision attack possible on MD5 if message is known partially

Is it possible to find $m'$ such that $\operatorname{MD5}(m'||m_1)=\operatorname{MD5}(m_1||m_2)$ if I know $m_2$ and $\operatorname{MD5}(m_1||m_2)$? Is this a collision or a preimage attack? Also in ...
3
votes
2answers
132 views

Generate a unique 64 bit numeric database key from a string without collisions at $2^{32}$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
5
votes
1answer
128 views

How can one detect if a hash function doesn't have a full image?

Suppose we have a hash function $H: \{0,1\}^* \mapsto \{0,1\}^n$, that doesn't get all the $n$ length bitstrings as a value for any input, but is otherwise secure. Can that fact be detected? For ...
2
votes
1answer
133 views

Probability for collisions of a one-way compression function

Given a one-way compression function $h:\{0,1\}^n \rightarrow \{0,1\}^m$ and an attacker that picks $x_1 \ldots x_t \in \{0,1\}^n$ (uniformly distributed), I have to show that the probability to find ...
2
votes
1answer
134 views

Is $H(x) = x^2 \bmod p$ pre-image resistant, second pre-image resistant and/or collision resistant

I have the function $H(x) = x^2\bmod p$ , where $p$ is a prime of length n bits and this function maps to the message $x$ to a n-bit hash value $H(x)$. I need to find out if it is pre-image ...
4
votes
1answer
86 views

Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?

I'm trying to learn about sponge function for creating hash functions and generic attacks on it. I'm looking for the collision finding attack scenario which leads to $O(\min(2^{-n/2} , 2^{-c/2}))$ ...
1
vote
0answers
36 views

space complexity of quantum collision search

Is there a known way to reduce the space complexity of quantum collision search beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below what ...
15
votes
6answers
9k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
6
votes
2answers
202 views

What is the MD5 collision with the smallest input values?

I am interested in MD5 collisions for small input messages. The collision examples given at http://www.mscs.dal.ca/~selinger/md5collision/ show two different strings, where only a tiny amount of data ...
1
vote
2answers
135 views

Current standard for hash function security parameter?

When designing a hash function, what should be the secure input and output lengths? In particular, what lengths do I need for collision resistance?
4
votes
1answer
143 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
2
votes
2answers
238 views

Difference between collision resistance and target collision resistance

For a hash function, what's the difference between Collision Resistance and Target Collision Resistance?. I understand the definition of hash function collision resistance, but I don't know about ...
12
votes
1answer
1k views

Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?

I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word ...
4
votes
2answers
351 views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...
5
votes
1answer
176 views

I need a 64-bit cryptographic hash for 96 bits of data

I have a situation in which I need to combine a 32-bit datum, G, and a 64-bit datum, I, to produce a 64-bit datum. No two ...
1
vote
1answer
85 views

Prove that two MACs with incremendal PRF application are not secure

How do I prove the following MACs are insecure?                                                        1                                                                                   2
1
vote
1answer
113 views

Hash functions with or without secret key

The classical definition of hash functions (found in books) are OK, but when studying a little more there is a lot of notions that seem ambiguous (contradictory) to me : Sometimes we have hash ...
1
vote
1answer
135 views

Does a break in a collision resistance property of a hash function by definition implies an attack at the first pre-image attack?

Is there a formal security proof in the shape of reduction that states that if an attacker manages to break the collision resistance property of a cryptographic hash function (a random oracle) he will ...
3
votes
1answer
103 views

md5sum collision question

I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities The wikipedia page above states: ...
20
votes
1answer
4k views

No SHA-1 Collision? Yet SHA1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)? If the answer is no than how can SHA1 be considered broken?
1
vote
1answer
75 views

Adversary to Any Collision Resistance Hash Function

I'm reading a notion Any Collision Resistance for Hash Functions. In the lecture define a collision finder CF. CF is said to $(t,\epsilon)$-break the family of hash functions $F_K$ if the ...
1
vote
0answers
38 views

TCR hash functions from MD5

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical (pag. 10 and 11) and here say The most direct way to construct a TCR hash function is to key a function like MD5 or SHA-1. ...
3
votes
2answers
202 views

Hashing SHA-512 1000 times

SageMathCloud security (http://goo.gl/dCujW1) is as follows: Only the hash of your password is stored by the server, which uses 1000 iterations of the sha-512 hash function, with a salt length of ...
0
votes
1answer
104 views

No Birthday Attack to TCR

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” , which compared TCR (Target Collision Resistant) and ACR (Any collision Resistant). It says we wish to stress ...
5
votes
3answers
736 views

Is the number of creatable torrents limited?

Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
2
votes
1answer
162 views

Brute force attack expected running time

I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of $2^n$ bits. Symmetric key cryptography: $E(brute)$ = ...
2
votes
1answer
54 views

Weaker Notion of Target Collision Resistance

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: While it might be easy to find a collision $M,M'$ in $F_K$ by making both $M,M'$ depend on $K$ ...
5
votes
1answer
146 views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
7
votes
1answer
674 views

Three-way hash collision

According to the birthday paradox we need approximately $O(|T|^{1/2})$ samples from the tag-space to find a collision for a hash function $h:K\times M \to T$. But how many samples are needed to find a ...
2
votes
1answer
69 views

Dependence on Keyed Hash Function

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: With an ACR hash function $F$ the key $K$ is announced and the adversary wins if she manages to ...
-2
votes
2answers
824 views

How many possible input files are there who's length can be stored in 63-bits?

I'm trying to calculate how many possible combinations of files there can be using a signed 64-bit file length, but can't seem to find a formula (or I'm using the wrong keywords). For example, the ...
-3
votes
1answer
836 views

Is it possible to generate an RSA SHA1 signature only from a public key?

Is it possible to generate signature only from Public key. See example below where i have valid signature but what if I change hash ? Is then any way to do this? Public key(160 bytes): ...
6
votes
2answers
317 views

Can the XOR of two non-collision-resistant hashes be collision resistant?

Suppose I have two hash functions, of which neither (or only one) is collision resistant, and I want to create a new hash function by taking the bitwise exclusive or (XOR) of the results of those two ...
1
vote
1answer
82 views

Would this prevent FNV1a 32 bit hash collision?

I am considering the FNV1a 32 bit hash as part of a simple software security and authentication system. I am aware that FNV1a is NOT ideal but it may suit my needs. I am aware that FNV1a has rather ...
1
vote
0answers
183 views

What is the chance of a collision when using SHA-3?

I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars). ...
0
votes
2answers
89 views

Is the composition of collision resistant hash with non collision resistant hash a collision resistant hash?

Suppose $h_1$ is collision resistant, and $h_2$ isn't. Will $h(x)=h_2(h_1(x))$ always be collision resistant? [Edited:] the output of h2 must be uniformly distributed
0
votes
1answer
46 views

Asymptotic Hash Function and Concrete Hash Function

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical, and they say that its formalization is non-asymptotic. Why is the formalization non-asymptotic? What is an example of hash ...
0
votes
0answers
40 views

Merkle-Damgard transform: necessity of the Length block [duplicate]

The Merkel-Damgard transform append the message length (in blocks) to the message itself and then computing the 'chained hash' algorithm. Does the last block (which contains the length of the ...
1
vote
0answers
36 views

MD Construction Doesn't Propagate TCR

I'm reading a proof of the proposition of CollisionResistant Hashing Towards Making UOWHFs Practical Suppose there exists a compression function $F: \Sigma^k\times\Sigma^{c+m'} \rightarrow ...
0
votes
1answer
89 views

SHA-1 Keyed Hash Function

I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is: How I will be able to formalize the ...
0
votes
1answer
94 views

Explicit Key SHA-1

I'm reading “Collision-Resistant Hashing? Towards Making UOWHFs Practical” and in the Section 2 it says: Hash functions like MD5 or SHA-1 have no explicit key. But no notion of ...
2
votes
2answers
85 views

MD5 theoretical question

Ok, so this is a very possible stupid question, but one of those things that has sat at the back of my mind for a while. We all know that MD5 has issues, and these have been known for about a decade. ...
1
vote
2answers
159 views

Are there attacks that break collision resistance but not preimage resistance?

Are there any examples of attacks on hash functions which: break collision resistance and second preimage resistant, or break collision resistance and preimage resistant? I have looked at ...
5
votes
2answers
302 views

Tunnels used in md5

I'm reading the paper "Message Freedom in MD4 and MD5 Collisions: Application to APOP" about finding collisions for the MD5 hash algorithm involving the concept of tunnels as described in "Tunnels in ...
2
votes
0answers
48 views

SHA-512 hash collisions [duplicate]

Possible Duplicate: Is SHA-512 bijective when hashing a single 512-bit block? Is there any guarantee that there are no collisions for all 512-bit input values for SHA-512 (every 512-bit ...
6
votes
2answers
3k views

Are there any known collisions for the SHA-2 family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
8
votes
3answers
3k views

What is pre-image resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?