A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
26
votes
2answers
1k views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
11
votes
2answers
541 views
Is SHA-512 bijective when hashing a single 512-bit block?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for SHA-2?
10
votes
2answers
839 views
Why is H(k||x) not a secure MAC construction?
If H(m) is a secure hash function, can't we implement a MAC using H(k||m)?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
4
votes
3answers
542 views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
10
votes
2answers
343 views
Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?
Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests?
Does the answer change if ...
5
votes
3answers
917 views
In the SHA hash algorithm, why is the message always padded?
In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s.
Why is it ...
13
votes
2answers
527 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
4
votes
1answer
313 views
From hash to Cryptographic hash
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
15
votes
3answers
672 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
10
votes
3answers
817 views
How well does scrypt perform on different architectures / OSes?
The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
8
votes
1answer
314 views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mid\mid x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k ...
3
votes
4answers
895 views
How are timestamps verified?
You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
4
votes
1answer
361 views
Is a second preimage attack on MD5 feasible?
What's the practical status of MD5 w.r.t. second-preimage?
Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
11
votes
1answer
826 views
No SHA-1 Collision? Yet SHA1 is broken?
Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)?
If the answer is no than how can SHA1 be considered broken?
7
votes
7answers
662 views
How can I improve a password generation scheme based on a shared secret and URL?
I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
...
7
votes
1answer
360 views
Should I use the first or last bits from a sha-256 hash?
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a sha-256 hash.
Should I take the first bits or the last bits? Which of them ...
5
votes
2answers
680 views
Strength of multiple hash iterations?
Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ...
4
votes
2answers
225 views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = ...
3
votes
2answers
398 views
How did LinkedIn “salt” all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
2
votes
4answers
617 views
Webapp password storage: Salting a hash vs multiple hashes?
For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better.
But, if bad guys steal your ...
6
votes
2answers
375 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
11
votes
2answers
1k views
“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?
In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm?
Similarly, what is the security difference ...
10
votes
5answers
632 views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key* by calling a pseudorandom function a bunch of times recursively:
...
9
votes
2answers
318 views
Is every output of a hash function possible?
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? If so, what guarantees ...
12
votes
3answers
868 views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
8
votes
4answers
1k views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
5
votes
4answers
992 views
What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?
If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
8
votes
4answers
609 views
Properties of PRNG / Hashes
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.
So, I was wondering how ...
7
votes
2answers
242 views
What is the purpose of using different hash functions for the leaves and internals of a hash tree?
I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
6
votes
1answer
273 views
Compressing EC private keys
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.
I ...
5
votes
1answer
338 views
How does a “Tiger Tree Hash” handle data whose size isn't a power of two?
Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two.
...
5
votes
2answers
1k views
Use of salt to hash a password
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
4
votes
3answers
556 views
What is the recommended replacement for MD5?
Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
4
votes
2answers
548 views
128 bit hash with least chance of collision
I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
2
votes
0answers
92 views
LT codes with Homomorphic hashing
I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ...
2
votes
3answers
424 views
Hash function in PBKDF2
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
10
votes
4answers
233 views
Do parts of a hash carry the properties of the entire hash?
When I need to generate unique id's based on some information hashing is typical choice. However, sometimes that id needs to be of a particular size. I've seen a lot of schemes (HMAC-MD5-96 in SSH, ...
10
votes
3answers
1k views
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
9
votes
4answers
424 views
Can you make a hash out of a stream cipher?
A comment on another question made me wonder about something:
Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
8
votes
1answer
278 views
Can one efficiently iterate valid bcrypt hash output values?
bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password.
An efficient attack on this would ...
6
votes
2answers
236 views
Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant Merkle–Damgård hash function $\mathcal{H}$ (e.g. SHA-1, RIPEMD-160, SHA-256, SHA-512). We define a Message Authentication Code $\mathcal{C}$
$$(k,m) ...
5
votes
2answers
158 views
Is there any research on the problem of making a number more memorable to humans?
Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
4
votes
1answer
221 views
OpenPGP Signature Packet hashed data
RFC 4880 describes the version 4 signature packet, tag 2, as
...
3
votes
1answer
224 views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
2
votes
2answers
131 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
2
votes
1answer
163 views
Are there any practical implementation of a homomorphic hashing or signature scheme?
A homomorphic hash function is a function $H : A \to B$ between two sets with some algebraic structure $(A, *)$ and $(B, \star)$ such that
$H$ is collision resistant, i.e. it is hard to find $x \neq ...
2
votes
1answer
93 views
Why are there $ signs in my passwd file?
I am trying to get access to my eReader and I managed to get the passwd file.
...
1
vote
1answer
49 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
1
vote
1answer
174 views
How do unkeyed hash functions (for MDCs) provide security?
Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
