# Tagged Questions

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

2k views

### Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
217 views

### KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
459 views

### Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
774 views

### What are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?

In a commitment scheme, are there any differences on using a symmetric cipher versus using a hash? If at the "opening", I have to reveal $r$ (a random number concatenated with the messaged at the ...
102 views

### Hashing a message with a length that isn't a multiple of 8 bits

NIST FIPS 180-4. “5.1. Padding the Message.” Suppose that the length of the message, $M$, is $l$ bits. Is there any library that can receive a message of length (in bits) which is not a multiple ...
351 views

### Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
1k views

### Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
267 views

### How to use salt if I am sending hashed password?

If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
372 views

### Finding a collision for a hash function

I'm trying to find a collision for the following (modified) Merkle–Damgård hash function. Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
194 views

### DIfferent inner and outer hash functions for NIST Recommended HMAC?

The NIST recommended HMAC uses $$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$ Is it ...
267 views

### Is there a known vulnerability when using identical key and salt with PBKDF2?

For optimum security, a random salt should be chosen for PBKDF2. I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...
406 views

### What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
98 views

### Change initial hash value of SHA512/t

Fips 180-4 defines under 5.3.6 how to calculate initial hash values for SHA512/t for a given value t. Can someone explain me how the t actually affects the outcome of the procedure (which, as far as I ...
57 views

### If I don't use XOR in Davies–Meyer, does it remain collision resistant?

If I don't use XOR in Davies–Meyer construction like in picture 2, does the function remain collision resistant?
73 views

### Reversing a hash of known hashing algorithm

I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this, So there is this hash function which operates on a message which is in the form of a byte array ...
96 views

I need to store passwords for a web application, and was looking at Bcrypt for a possible solution. After some research, it appears only the first 72 bytes influence the final hash output. While it is ...
126 views

### What is tiger192,4 in PHP?

PHP supports hashing of the following Tiger algorithms: tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 Wikipedia's entry on Tiger says there's Tiger and Tiger2 and provides ...
255 views

### Hash functions to generate one time pad

Newbie question... may be... Stream cypher, will XOR message bits with one time pad bits Suppose I have a pseudo random number generator, like a Mersenne twister or sort of. I could use the speudo-...
97 views

### Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere. I think it should be 64 bits, but I'd feel safer if somebody who has ...
175 views

### Save the last cycle in GCM GHASH calculation

I need to implement GCM GHASH in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size is fixed and AAD is 0. A little example: ...
173 views

### How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?

Suppose I have two arrays : A = a single byte, being zero. B = two bytes, both being zero. B = A||0 (i.e. B starts with A, and differs only by appending a zero byte) BLAKE2(A) != BLAKE2(B) Yet, ...
131 views

### Memory-expensive hash from an array of hashes?

Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking? What I have in mind myself is this: We have an input $X$, we ...
377 views

### Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity?

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity? My reasoning is that the attacker doesn't know all the plaintext, so by having a hash, the ...
126 views

### Is there a practical upper limit for password rehashing?

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security? Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, ...
331 views

### Does adding a salt to the message before HMAC processing add any security?

An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...
897 views

### Cryptographic hash function for 32-bit length input keys

Since I'm unfamiliar with cryptography area I haven't been able to find cryptographic hash functions for 32 bit integer keys. It seems all such functions (as I saw here) are designed to digest a ...
584 views

### Is SHA-256 safe when used in this way?

I am wondering whether an attacker can gain any useful information from having several hashes of an unknown plaintext that differs in relatively few bits. For example, if provided with: ...
275 views

### Increased security weaknesses when truncating SHA1

Given the following preconditions: A plaintext A (~512bit length), that is hashed by using SHA-1 and truncated to (the first) 64 bits. I know both, the plaintext and the truncated hash, and want ...
612 views

### File Hash of Encrypted File

Simple question. I have a source file and I have encrypted it with a certain public key. If I take this exact same source file, encrypt it with the exact same key a few hours later would the file hash ...
153 views

### Feedback requested on a method of posting a message without revealing the author

So I was thinking about variations on the Dining Cryptographers problem - In some cases, it's useful to be able to post a message without revealing the source, but with the additional constraint of ...
175 views

### How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
83 views

### Salting Hash stored on RFID tag?

In my application, I am trying to prevent counterfeit widgets from being used on our gadgets; think HP ink-cartridges. I will be doing such with UHF RFID tags embedded in the widgets. Unfortunately, ...
71 views

### Are there any hash functions that use integers of arbitrary bit size (e.g., int63)?

More precisely, I am looking for hash functions where the internal state can be decomposed as a vector of integers of size 63. That is, machine integers where one of the bits is fixed and unusable.
69 views

### Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...
153 views

### Memory hard key derivation (password hash) using AES encryption

I am restricted on a certain environment involving PHP and am currently unable to implement new memory hard hashes such as scrypt (and I am not trying to compete with the likes of scrypt). My ...
63 views

### Given just the hash of a file, can I verify that the file contains a specific data block?

Imagine I only have the hash of a file which we can call hash(file). Then a user sends me a data block (or section) of the same file, which we can call ...
127 views

### How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I ...
126 views

### Proof that two parties can communicate

Suppose we have three parties, Alice, Bob, and Carol. Alice can receive messages from Bob and Carol individually, but can only send messages to both simultaneously. Additionally, Alice cannot tell if ...
123 views

### Do hand-based hash functions / MACs exist?

Is there research on a hash function or a MAC that can be executed without computers? I know there's a lot of history on hand-based ciphers and the OTP can easily be excecuted by hand. (By using ...
172 views

### Why is C_digest defined in PKCS#11?

Digesting doesn't require any key and can be performed on the client side. Why does the PKCS#11 token interface standard have a C_digest method? For example, why should I send my data to a PKCS11 HSM ...
145 views

### Security concern about reducing hash value using modulo operation

As stated in the title, what I am looking for is information about a "technique" that I would like to use in some of my algorithms. Sometimes I need to map a hash function's result into a range of ...
121 views

### Is this an acceptable All-or-Nothing Transform?

I was thinking about AONTs, and designed the one below, I call it CHANT for Chained-Hash All-or-Nothing Transform; it's my very first shot at something of the sort, and was hoping I could get your ...
141 views

### Key-dependent encryption in TAHOE-LAFS

TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key SK is encrypted with the truncated hash of the private key: ...
324 views

### A fast non-cryptographic hash function that is “strong enough”?

I'm designing a simple one-time-password mechanism for authentication against a possibly-insecure server - i.e. I don't want to use symmetric shared secrets. The first idea that came into mind was ...
130 views

### Combining two hashing functions

I have been working on a Bloom Filter implementation recently and after a discussion with a co-worker about how many hashing functions to use I told him I was limited with using hashing functions that ...
349 views

### Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?

I'd like to find a way to anonymize IP addresses in web logs to ensure user privacy given the following requirements: If given an IP address, there is no way to look up which requests came from the ...
703 views

### What does “message schedule” mean in SHA-256?

I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15): For $i = 1$ to $N$: { ...
486 views

### Order of hashing concatenation

A = hash("blue" + X); B = hash("pink" + X); If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()? ...
Imagine the following senario. We have $n$ participants. Participant $i$ has a set of elements $S_i$ with the elements being in a random order, possibly different for each participant. The ...