# Tagged Questions

Difficulty of finding two different inputs that hash to the same value

3k views

### Probability of SHA256 Collisions for Certain Amount of Hashed Values

I wonder if you can help me figure out that question: Is there a known probability function f: N -> [0,1], that computes the probability of a sha256 collision for a certain amount of values to be ...
63 views

### How to create reduction functions in rainbow tables?

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
34 views

### What is many:1 and collision in MD5?

This is in reference to this answer on Stackoverflow. If you read the first paragraph of the answer, you'll find this line: It's always a many:1 mapping (meaning there will always be collisions) ...
673 views

### Creating a hash of XOR'd blocks

Suppose a message $m$ is divided into blocks of length $160$ bits: $m > = M_1 || M_2 || ... || M_l$ And define $h(m) = M_1 \oplus M_2 \oplus ... \oplus M_l$ Which of the three desirable ...
38 views

### PBKDF2 with the same salt for all IDs

I have a unique identifiers that I would like to keep secure and provide information about it through tokens. These tokens should be verifiable after using the same algorithm on other end system with ...
68 views

### Keyless Signature Infrastructures as a secure Post-Quantum Scheme

I came across a company that relies on hashing, similar to block chain technology. They explicitly stated in their white paper that hash based cryptographic schemes are inherently post-quantum ...
159 views

### Why do different applications of hash functions demand different properties of the hash function?

A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
53 views

### Encoding an element in $r=r'||h(r')$ way

We consider a finite field $\mathbb{F}_p$, where $p$ is a large prime e.g. 256-bit. We have $b$ a fixed element of the field. We encode it as $b'=b||h(b)$, where $h(.)$ is a cryptographic hash ...
39 views

### Proof for collision resistance on a block-based hash

I am designing an unkeyed hash based on the SIMON cipher. This is a follow up to “this” question. A quick summary: I have an ECC engine and the SIMON cipher in hardware, and it’s in an extremely ...
52 views

### How is a hash function that implements random oracle model collision resistance?

ROM is considered as collision resistance. Does ROM assume there is an infinite set of output, or assume the output set is always larger than the input set? Because by the pigeonhole principle, ROM is ...
72 views

### Enhance security by combining bits of 4 different hashes

Assuming that performances do not matter, is there any real benefit in terms of security (in general) in combine hashes in this way: hash functions: ...
161 views

### Is it possible to brute-force a hash algorithm of 32 bits

I have a 30000 user passwords and usernames stored in a table on a database in which the passwords are stored as hash where ,I need to guess the passwords for all users and I have the hash function ...
58 views

### Can the attack in https://eprint.iacr.org/2008/469.pdf be parallelized?

Can this attack be parallelized? It is a $2^{57}$ complexity collision attack on SHA-1 based on disturbance vectors. If it is practical it is easy on a GPU ($\approx1.1$ GPU-days). If it is ...
65 views

### How hard is it to generate a simultaneous MD5 and SHA1 collision?

I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The ...
88 views

### How to hash a set of elements

Imagine the following senario. We have $n$ participants. Participant $i$ has a set of elements $S_i$ with the elements being in a random order, possibly different for each participant. The ...
64 views

### Probability of hash collision in exhaustive mapping from input to output

Suppose I had a hash function which produced a 256-bits output for any given input (such as SHA-3-256). Now suppose i did an exhaustive mapping from every possible 512-bits input to a given 256-bits ...
57 views

### If I don't use XOR in Davies–Meyer, does it remain collision resistant?

If I don't use XOR in Davies–Meyer construction like in picture 2, does the function remain collision resistant?
32 views

### How feasible is a preimage attack or speedups to brute force a substring of MD5?

Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four ...
76 views

### Combining secure hashes with insecure hashes?

Assuming I'm a bank which seeks for secure hash functions to use in the process of signing on digital contents. I'd like to explain / prove why using each one of the following hash functions might ...
11k views

### Are there any known collisions for the SHA (1 & 2) family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
1k views

### Is the number of creatable torrents limited?

Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
4k views

### Is calculating a hash code for a large file in parallel less secure than doing it sequentially?

I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size. Normally, you sequentially hash the bytes of the files using a hash function (say, ...
1k views

### Change in probability of collision when removing digits from MD5 hexadecimal hash values

I am aware that MD5 has a known collision vulnerability and should not be relied upon when uniqueness is required, but in the environment I am working on I only have access to MD5 hash function. ...
4k views

### What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
37k views

### Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
59 views

### Safe MD5 digest

So I've heard that MD5 is broken because it's possible to engineer collisions. So instead we should use, say, SHA256. The problem which SHA256 digests is that they are long. So I've come up with this: ...
61 views

### How to find collisions in a hash function knowing its coefficent?

Say I have a simple hash function where $x$ is a sequence of integers: $$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$ where $a_1,a_2,a_3,...,a_n$ is the coefficient ...
72 views

### SipHash's (non-)collision resistance

I'm very new to cryptography, and I need help understanding the security claims made in Aumasson and Bernstein's paper on the SipHash. In particular, I'm trying to understand the following statement ...
45 views

### Is it safe to use fast/small hash for key identity?

I have to roll database access keys often, but it's important to know which key each system is using in order to avoid unavailability. I want the systems to report that without exposing the key itself,...
86 views

### Why are hash functions like SpookyHash and MurmurHash so highly collision resistant?

Why are hash functions like SpookyHash and MurmurHash so highly collision resistant? I tried to test these hash functions using a few billion input messages and I found that there is no hash value ...
155 views

### Is finding collisions in a part-hash not often enough a bad problem?

My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at ...
55 views

### Collision-Resistance Hash Function PRF

I am trying to solve the following question with an example/proof. The question is from Introduction to Modern Cryptography by Katz and Lindell. Any help would be appreciated.
140 views

### How to construct a collision resistant hash function that is not a one-way function?

How to construct a CRHF (collision resistant hash function) that is not a OWF (one-way function)? Not sure but I think it probably needs another CRHF?
127 views

102 views

### Weak and Strong Collision Resistance, again

Weak collision resistance (CR), or second-preimage resistance, is the property that given $x$ and $h(x)$ ($h$ a hash function) it's difficult to find $x' \neq x$ such that $h(x') = h(x)$. Strong CR, ...
82 views

### “Security” of SHA functions (Wikipedia), what does it mean?

Wikepedia's table Comparison of SHA functions mentions "Security(bits)" for some SHA functions. From the ratio (Output size (bits): Security(bits)), I feel it is something like "collision resistance". ...
6k views

### Why is HMAC-SHA1 still considered secure?

This Q & A http://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
68 views

### Why is the compression function in Miyaguchi-Preneel scheme secure?

I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I ...