A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (2)

3
votes
3answers
780 views

What are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?

In a commitment scheme, are there any differences on using a symmetric cipher versus using a hash? If at the "opening", I have to reveal $r$ (a random number concatenated with the messaged at the ...
1
vote
1answer
172 views

Would this prevent FNV1a 32 bit hash collision?

I am considering the FNV1a 32 bit hash as part of a simple software security and authentication system. I am aware that FNV1a is NOT ideal but it may suit my needs. I am aware that FNV1a has rather ...
1
vote
1answer
165 views

Does it make sense to stretch non-keys?

I was thinking about stretching salt. Key-stretching is good against brute force guessing and assumes your system isn't compromised. Salting a one-way makes it so you have to compute * n for each ...
0
votes
0answers
239 views

If H(m) = 0 for some m, how can a DSA signature be forged?

If we know for some message $m$ that $H(m) = 0$, how can we forge a DSA signature with only the public key? I got that $g^s*r = (g^x)^r$ where $x$ is the private key, but that's one equation with 2 ...
1
vote
2answers
221 views

Is the composition of collision resistant hash with non collision resistant hash a collision resistant hash?

Suppose $h_1$ is collision resistant, and $h_2$ isn't. Will $h(x)=h_2(h_1(x))$ always be collision resistant? [Edited:] the output of h2 must be uniformly distributed
2
votes
2answers
242 views

Splitting a password for dual roles [duplicate]

I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input. I'm essentially looking for a box where ...
2
votes
2answers
164 views

Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
1
vote
2answers
341 views

scrypt and bcrypt for benefits of both?

I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ...
2
votes
0answers
168 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
1
vote
1answer
587 views

Tamper-evident audit logs

I want to be able to detect tampering in a log file that is under the control of an untrusted party. I am not interested in secrecy, only the integrity of the contents in the file - so I want to ...
10
votes
1answer
675 views

Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
1
vote
1answer
1k views

How to put the hash of a PDF file in the PDF file? [duplicate]

I know it sounds strange.. but, are there any ways in practice to put the hash of a PDF file in the PDF file? And after geting the hash in the PDF file - if someone would do a hash check of the PDF ...
8
votes
2answers
574 views

Why xor the message into the state for sponge hashes?

Sponge hashes like Keccak(SHA-3) and CubeHash, xor a message block into part of the internal state. Why use a reversible operation like xor for that, instead of replacing that part of the state with ...
1
vote
1answer
127 views

SHA-1 Keyed Hash Function

I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is: How I will be able to formalize the ...
4
votes
1answer
359 views

Is there a cryptographic hash function that can be performed with pencil and paper?

Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ...
0
votes
1answer
117 views

Explicit Key SHA-1

I'm reading “Collision-Resistant Hashing? Towards Making UOWHFs Practical” and in the Section 2 it says: Hash functions like MD5 or SHA-1 have no explicit key. But no notion of collision-...
2
votes
2answers
134 views

MD5 theoretical question

Ok, so this is a very possible stupid question, but one of those things that has sat at the back of my mind for a while. We all know that MD5 has issues, and these have been known for about a decade. ...
0
votes
1answer
181 views

Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant? [duplicate]

Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is ...
3
votes
1answer
141 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
1
vote
1answer
1k views

Hash functions throughput performance [closed]

Without taking into account security, which hash function is the fastest one among the following: MD5, SHA-1, SHA-2 (for various internal size), Keccak, and other… ?
6
votes
2answers
4k views

Using a Hash as a secure PRNG

I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
1
vote
2answers
3k views

HMAC vs Encrypted Hash

What is best to use (for message integrity) between… AES(Data) + HMAC(Data) AES(Data + HMAC(Data)) AES(Data + Hash(Data)) …and why?
1
vote
1answer
104 views

Hash of multiset of values, which lets me compute the hash of the union

Cryptographic hash functions normally take as input a bitstring. I am looking for a hash function that takes as input a finite multiset of values. In other words, given $S \subset \{0,1\}^*$, I want ...
2
votes
0answers
111 views

How does use of HMAC affect hash function combiners?

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)...
5
votes
1answer
271 views

HMAC construction based on the combination of two hash functions

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of $\operatorname{HMAC}(...
2
votes
2answers
335 views

Are there attacks that break collision resistance but not preimage resistance?

Are there any examples of attacks on hash functions which: break collision resistance and second preimage resistant, or break collision resistance and preimage resistant? I have looked at Rogaway'...
2
votes
1answer
168 views

How do you use the Tiger hash function with GPG?

I've searched Google and the GnuPG documentation and I haven't been able to find an answer. Some pointers in the right direction would be greatly appreciated.
52
votes
1answer
26k views

What are the differences between a digital signature, a MAC and a hash?

A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed?
6
votes
1answer
163 views

What's the state of the attack to get the first pre-image on MD4?

What's the state of the attack to get the first pre-image on MD4? Is it still $2^{102}$ as described by Gaëtan Leurent in "MD4 is Not One-Way" ?
4
votes
1answer
779 views

How can I generate a one-time password?

Through my reading about the generation of one-time password (OTP) I found that there are many algorithms that generate OTP and they are either based on time such as TOTP or based on mathematical ...
5
votes
5answers
998 views

Would it be possible to generate the original data from a SHA-512 checksum?

So, I have a file that is XY Exabytes big. I create a SHA-512 hash from it. Are there any theoretical chances that I can retrieve the original data just from the sha512 hash? Also, are there any ...
19
votes
1answer
2k views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
3
votes
2answers
345 views

Does encrypting a hash of the message yield a secure MAC?

Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property. For ...
5
votes
1answer
224 views

Proof that MACing a hash of the message is also a secure MAC

I found a theorem that says: Let $MAC = (S,V)$ be a MAC for short messages over $(K,M,T)$. Let $H: M^{big} → M$. Define $MAC^{big} = (S^{big},V^{big})$ over $(K,M^{big},T)$ as: $S^{big}(k,m) = S(k,H(...
21
votes
4answers
686 views

Necessity of Randomness of Salts?

Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user? If your system already has some other unique user ...
11
votes
2answers
1k views

Is the encryption of a hash a good MAC?

At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = \mathrm{hash}(k||\mathrm{data})$...
2
votes
3answers
476 views

Can one build a one-way function from AES?

We change the AES block cipher encryption: we delete the key schedule algorithm the user now provides a string of 1408 bits we divide the string to 11 sub keys, and use them directly in the ...
12
votes
4answers
2k views

Is it feasible to build a stream cipher from a cryptographic hash function?

A few years ago I devised a symmetric-key system that worked like so: ...
2
votes
1answer
331 views

2 comparable hashes generated from one string

Assume a website where people log in with their password. The password is now stored in sql database as: md5(password + random_salt) We are adding the ...
2
votes
0answers
212 views

Infinite depth BLAKE2b tree hashing

In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] ...
0
votes
1answer
593 views

WIN LM Password Hashes (using John the ripper) [closed]

In a problem set, we've been asked to use John The Ripper to crack a list of Win LANMAN passwords. They are of the following form: 953A55E36AB85C0B9DA92C18555E42E1:0169295E0A6A6B35B2DD9932D10C1978 ...
2
votes
0answers
589 views

Question about modifying the MD5 plain text to cause a collision

I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ...
2
votes
1answer
667 views

How hard/easy will be to break a SHA-1 or SHA-256 hash if the attacker knows part of the original text?

I'm creating an algorithm to hash some text variables (20/30 characters long) to send them across an insecure channel. I'm not dealing with high security data, so no credits card numbers or any other ...
3
votes
1answer
102 views

Hashing a message with a length that isn't a multiple of 8 bits

NIST FIPS 180-4. “5.1. Padding the Message.” Suppose that the length of the message, $M$, is $l$ bits. Is there any library that can receive a message of length (in bits) which is not a multiple ...
4
votes
2answers
2k views

Difference between salted hash and keyed hashing?

A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash ...
2
votes
0answers
155 views

How hard is a known prefix hash preimage attack?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
7
votes
1answer
2k views

Commitment scheme using hash functions

Let's say Alice and Bob are playing a game where Bob is trying to guess a number Alice has chosen. Alice chooses a key $K$ and a number $N$ at random and performs $C=Commit(K, N)$ where $Commit(K, N)=...
4
votes
1answer
618 views

Why must curve25519 shared secret be hashed?

When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that? Hashing won't increase the ...
14
votes
3answers
1k views

Are NIST's changes to Keccak/SHA-3 problematic?

NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as SHA-...
2
votes
2answers
316 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...