A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
26
votes
2answers
1k views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
18
votes
4answers
433 views
Necessity of Randomness of Salts?
Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user? If your system already has some other unique user ...
15
votes
3answers
672 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
15
votes
3answers
226 views
What differentiates a password hash from a cryptographic hash besides speed?
I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ...
14
votes
3answers
1k views
Reverse engineering a hash?
I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question.
I have inputs and outputs from an ...
13
votes
2answers
532 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
13
votes
3answers
2k views
Is there a simple hash function that one can compute without a computer?
I am looking for a hash function that is computable by hand (in reasonable time). The function should be at least a little bit secure: There should be no trivial way to find a collision (by hand). For ...
12
votes
2answers
329 views
What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Since most cryptographic hash functions are simple, compact constructions does this simplicity impose a limit on the complexity and the size of a function that can generate preimages? That is, given a ...
12
votes
3answers
870 views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
11
votes
2answers
542 views
Is SHA-512 bijective when hashing a single 512-bit block?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for SHA-2?
11
votes
1answer
835 views
No SHA-1 Collision? Yet SHA1 is broken?
Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)?
If the answer is no than how can SHA1 be considered broken?
11
votes
2answers
1k views
“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?
In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm?
Similarly, what is the security difference ...
10
votes
5answers
632 views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key* by calling a pseudorandom function a bunch of times recursively:
...
10
votes
2answers
842 views
Why is H(k||x) not a secure MAC construction?
If H(m) is a secure hash function, can't we implement a MAC using H(k||m)?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
10
votes
3answers
1k views
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
10
votes
2answers
344 views
Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?
Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests?
Does the answer change if ...
10
votes
2answers
439 views
Why do we append the length of the message in SHA-1 pre-processing?
As we know, SHA-1 is irreversible, so why do we append the length of the message to the preimage?
10
votes
4answers
233 views
Do parts of a hash carry the properties of the entire hash?
When I need to generate unique id's based on some information hashing is typical choice. However, sometimes that id needs to be of a particular size. I've seen a lot of schemes (HMAC-MD5-96 in SSH, ...
10
votes
3answers
819 views
How well does scrypt perform on different architectures / OSes?
The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
9
votes
3answers
545 views
Why does the padding in MD5 contain the message length?
I understand the need for padding in MD5. But why do we append the message length to the padding?
I heard it strengthens the hash but how?
Please provide an example if possible and how it applies to ...
9
votes
2answers
1k views
Why use an Initialization Vector (IV)?
Why use an Initialization Vector (IV)?
How are IV's used?
What are the advantages/disadvantages of using an IV?
Why use an IV instead of a longer key in which some section of the key is pubic?
What ...
9
votes
2answers
318 views
Is every output of a hash function possible?
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? If so, what guarantees ...
9
votes
5answers
482 views
How do I construct a 256-bit hash function from 128-bit AES?
I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher?
9
votes
2answers
927 views
What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?
For the purposes of signing and verifying signatures, what is the value of the hash function?
Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
9
votes
7answers
1k views
Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size.
Normally, you sequentially hash the bytes of the files using a hash function (say, ...
9
votes
4answers
424 views
Can you make a hash out of a stream cipher?
A comment on another question made me wonder about something:
Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
9
votes
2answers
317 views
Proving knowledge of a preimage of a hash without disclosing it?
We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256.
Alice discloses a value ...
9
votes
1answer
184 views
Which MACs can be converted into a secure unkeyed hash function?
It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
8
votes
5answers
2k views
Are there two known strings which have the same MD5 hash value?
Is there an example of two known strings which have the same hash (MD5) value, i.e. an MD5 collision?
8
votes
4answers
610 views
Properties of PRNG / Hashes
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.
So, I was wondering how ...
8
votes
3answers
1k views
How can a random salt for a hash function work in practice?
I understand the theory behind the use salts in hash functions, but when I see it implemented, the implementations always generate the salt on the fly and the salt appears to be different for every ...
8
votes
4answers
1k views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
8
votes
2answers
194 views
Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?
I can't get an intuitive understanding of why it's $2^{(\frac{n}{2})}$ and not $2^n$, where $n$ is the number of bits of which the key consists.
8
votes
1answer
314 views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mid\mid x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k ...
8
votes
1answer
279 views
Can one efficiently iterate valid bcrypt hash output values?
bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password.
An efficient attack on this would ...
7
votes
7answers
662 views
How can I improve a password generation scheme based on a shared secret and URL?
I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
...
7
votes
3answers
307 views
Is it safe to use file's hash as IV?
I'm encrypting some files using AES in CBC mode.
I'm also using file's digest (SHA-1) to check that data is decrypted correctly (so I need to store it with file).
Is it safe to use this digest as ...
7
votes
1answer
361 views
Should I use the first or last bits from a sha-256 hash?
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a sha-256 hash.
Should I take the first bits or the last bits? Which of them ...
7
votes
3answers
1k views
What is pre-image resistance, and how can the lack thereof be exploited?
What is preimage resistance, and how can the lack thereof be exploited?
How is this different from collision resistance?
Are there any known preimage attacks that would be considered feasible?
7
votes
2answers
242 views
What is the purpose of using different hash functions for the leaves and internals of a hash tree?
I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
7
votes
2answers
314 views
What is a hard-core predicate?
I read this article on Wikipedia: Hard-core predicate.
Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a ...
7
votes
1answer
368 views
Change in probability of collision when removing digits from MD5 hexadecimal hash values
I am aware that MD5 has a known collision vulnerability and should not be relied upon when uniqueness is required, but in the environment I am working on I only have access to MD5 hash function. ...
7
votes
1answer
1k views
RIPEMD versus SHA-x, what are the main pros and cons?
RIPEMD is a family of cryptographic hash functions, meaning it competes for roughly the same uses as MD5, SHA-1 & SHA-256 do. The Wikipedia page for RIPEMD seems to have some nice things to say ...
6
votes
2answers
515 views
understanding a length extension attack
I have been trying to understand exactly how a length extension attack works on SHA1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully get ...
6
votes
1answer
168 views
Can I find two specific words with the same md5 hash?
I want to find two strings containing special words like "yes" or "no", mixed with random characters, for which the MD5 hash is equal.
An example of what I'm looking for:
...
6
votes
1answer
141 views
Is Wikipedia's table about SHA-2 collisions correct?
I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1.
Is this true, or is the table wrong / misleading?
...
6
votes
1answer
273 views
Compressing EC private keys
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.
I ...
6
votes
3answers
405 views
Counter mode secure hash algorithm
Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. ...
6
votes
3answers
517 views
What security does Keccak offer against quantum attacks, specifically Grover's algorithm?
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:
Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second ...
