A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
0answers
64 views

RSA - Why should we sign hash rather than raw content? [duplicate]

Apart from obvious performance considerations, is there any mathematical or crypto reasons that imply that we sign a hash rather than a raw content ? I read that it was because the hash must fit in ...
0
votes
2answers
40 views

How to use HMAC for authenticating multiple messages

The standard HMAC function, $H(K, m)$, authenticates a single message $m$. Instead, I'd like to authenticate 2 messages, like this: $$H'(K, m_1, m_2)$$ The simplest solution, $H(K, m_1||m_2)$, ...
0
votes
0answers
70 views

Formal proof of theorem concerning the Random Oracle Model

Reading a book on cryptography by Douglas R. Stinson I've met the following theorem, which is stated without proof (see here). Thereby, $\mathcal{F^{X,Y}}$ denotes the set of all functions from ...
8
votes
1answer
613 views

What are the security implications of multiple hashing?

There are plenty of questions on this site about hashing passwords. However, none of them quite cover this topic. One of those links covers using multiple different hash algorithms; one covers general ...
1
vote
1answer
197 views

Generalize the Merkle–Damgård construction for any compression function

I am trying to figure out this question: Generalize the Merkle–Damgård construction for any compression func­tion that compresses by at least one bit . You should refer to a general input ...
0
votes
1answer
53 views

Calculate number of chips to solve bit commitment using hash function

I have a problem that I don't know how to solve Assume that H is a cryptographic hash function with output size 80 bits. Assume that ABC123 is a specifically designed line of hardware chips for ...
1
vote
1answer
56 views

Associative but NOT Commutative Reducing Function Construction with Existing Hash Function(s)

Is it possible to construct a binary reducing function based on any existing cryptographic hash function satisfying the associative property but not the commutative property? So formally: Using an ...
2
votes
2answers
72 views

Security concern about reducing hash value using modulo operation

As stated in the title, what I am looking for is information about a "technique" that I would like to use in some of my algorithms. Sometimes I need to map a hash function's result into a range of ...
3
votes
1answer
134 views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = ...
7
votes
0answers
121 views

How were shift amount constants in MD5 found?

The md5 specification gives a series of 4 rounds to execute over a 16-word block. Each round has a repeating sequence of 4 shift amounts (s in ...
-2
votes
1answer
85 views

Best hash-algorithm [closed]

What is the most secure hash-algorithm. Can you also give the second best and the third best like this: 1. Test 2. test 3. TEST I dont care about the performance
2
votes
0answers
52 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
1
vote
0answers
40 views

The purpose of the final xor in Davies–Meyer scheme [duplicate]

In Davies–Meyer hash construction scheme each block is xor'ed with the previous block cipher text. Why? The only obvious flaw I see in a scheme without this xor is the possibility to reconstruct a ...
2
votes
1answer
274 views

Finding a collision for a hash function

I'm trying to find a collision for the following (modified) Merkle–Damgård hash function. Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
1
vote
1answer
104 views

N way collision of hashes

For a collision $H(A_1) = H(A_2)$, the number of queries is $T^{1/2}$ where $\log_2(T)$ is length of hash output. Then, what would be the number of queries requried to find an $n$-collision ($H(A_1) = ...
0
votes
0answers
51 views

Recovering a constant salt for MD5 [duplicate]

I have STRING and MD5(STRING+SALT) for any infinitely many STRING's. Is their any way that I can recover the SALT itself? (SALT is constant) I actually know SALT, but this is an intellectual exercise. ...
3
votes
3answers
162 views

Statistical properties of hash functions when calculating modulo

When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the ...
0
votes
0answers
66 views

Are there any proofs of the SHA1 compression function's (second-)preimage resistance?

Why is SHA1 preimage-resistant? The best reference that I can find is Rogaway & Shrimpton's 2009 paper, and I'll use their definitions. The kind of preimage resistance that is wanted is aPre. ...
2
votes
2answers
766 views

Can a salt for a password hash be public?

For my understanding salts in password hashes are used to prevent the precomputation of $plaintext \to hashvalues$ (rainbow tables). I know from different threads, it is not necessary to keep the ...
0
votes
1answer
44 views

Is there (this) a case in which salting is dispensable?

tl;dr this is not a duplicate of "what is a salt/why use salt?" question. Instead it is specificly asking when salt may not be necessary for hashing securly? (i.e. when the data being hashed is ...
3
votes
2answers
109 views

Memory-expensive hash from an array of hashes?

Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking? What I have in mind myself is this: We have an input $X$, we ...
1
vote
1answer
51 views

MD-compliant hashes don't really accept arbitary length input, do they?

When people talk about hash functions, they usually say that they accept arbitrary-length input, but if you actually look at the padding (eg MD-strengthening padding), you see it's like ...
-1
votes
1answer
53 views

HMAC ipad and opad choice

It is written in the HMAC paper that the $ipad=0x36$ and $opad=0x5c$ were chosen such that it maximize the Hamming-Distance of the part of the key used in the inner and outer part of the HMAC process. ...
7
votes
2answers
244 views

Definition of “pepper” in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, a ...
3
votes
3answers
220 views

Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
3
votes
3answers
281 views

SHA1 Collisions - what about practical attacks?

I understand the theorical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of strucutred piece of ...
0
votes
1answer
88 views

Is any group of bits in a SHA-1 hash more/less unique than another?

Is there any bias in certain parts of the hash? E.g., first n bits are more/less unique than the last/middle n bits? Is there ...
0
votes
1answer
61 views

Complexity of preimage resistance

Why is the complexity of pre-image resistance $2$ raised to the power of $n$? I have been looking in everything lecture about pre-image resistance, but I still didn't know the answer.
0
votes
1answer
54 views
3
votes
2answers
147 views

Can a secret message be securely transmitted within a MAC tag?

A sender wants to transmit an ultra secret code $M$ which could be either 'go', 'stop' or 'wait'. This could be any selection of code words really and adopted for any use such as transmitting short ...
-1
votes
1answer
104 views

Reversing a Psuedo Crytographic Hash [closed]

I'm trying to get a better understanding of cryptographic hashing. Take the example transformation function below, is it possible to reverse this formula to solve/isolate for message[i]? ...
0
votes
1answer
68 views

How to figure out the size of the output of a cryptographic checksum function

There is such a putting in Bishop's Introduction to computer security, page 118 as following: Definition 8–2. A cryptographic checksum function (also called a strong hash function or a strong ...
0
votes
1answer
114 views

SHA1 - SSL/TLS Cipher Suite

SHA-1 is on the way to deprecation, in particular for digital certification (x509). But I can't find ressources about SHA-1 deprecation from SSL/TLS Cipher Suites. Is it implicit, as deprecation ...
1
vote
2answers
158 views

Different padding rules for Merkle–Damgård and Keccak/sponge function

We learned that length padding was used in Merkle–Damgård where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
1
vote
0answers
80 views

Less known hash functions producing 128 bit hash

Good day. While reversing a malware I stumbled upon a function producing 16 byte hash. I tried to determine which one is that by checking every function from wiki. Nothing fits. So, there are two ...
0
votes
0answers
51 views

Efficient proof of knowledge using Wegman-Carter hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
2
votes
2answers
113 views

Large file validation on an embedded system through hash and encryption

As a preface, I have to say that I am a noob in this area. Having said that, I will ask the question. I have a situation where I need to validate and protect against tampering a handful of large ...
1
vote
1answer
132 views

Hash collision using the leading 40-bits of SHA-1

I am trying to implement Floyd's cycle finding algorithm for finding a leading 40-bit hash collision in the SHA-1 algorithm. However, my code will not find a repetition even with 800,000,000 hashes. ...
0
votes
0answers
27 views

Designing hash function in space-efficient identity based encryption

Let $n$ be an RSA-prime and we know prime factorization of $n(=pq)$. The hash function is the current context maps from a given user identity(id) to a positive integer less than $n$, whose jacobi ...
-1
votes
1answer
206 views

Collision resistant hash functions

Let (Gen1,H1) and (Gen2,H2) be two hash functions. Define (Gen,H) so that Gen runs Gen1 and Gen2 to obtain keys s1 and s2, respectively. Then define Hs1,s2(x)=Hs1(x)||Hs2(x). a) Prove that if at ...
0
votes
0answers
79 views

Complexity to find an preimage of a hash function

Suppose a hash function based on Merkle-Damguard construction. Its compression function is given as $H_i=E_{m_i}(H_{i-1})$, where $E_{m_i}()$ denotes the encryption of an ideal block cipher with ...
2
votes
5answers
513 views

Can hashing become encrypting?

hashing some data and encrypting data share some similar attributes. Surely this is why "Difference between encrypting something and hashing something" has been asked. The point of this question is ...
13
votes
2answers
741 views

Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
1
vote
0answers
29 views

Pros and cons between HOTP and TOTP [duplicate]

I'm reading the RFC6238 (TOTP) and RFC4226 (HOTP) standards and can't get which one is to prefer? I've searched around a bit and it seems like TOTP is the one that is most used, but some argue that ...
0
votes
0answers
40 views

Test framework for hash functions for collision resistance?

I have two questions about the assessment of collision resistance in hash functions. Given a hash-function what would be the next step to inquiry about it's collision resistance / probability of ...
0
votes
4answers
83 views

Why do we need to compute message digest of a message first while signing it?

Why it is more efficient to compute a message digest of message and digitally sign it then, rather than sign the message directly?
0
votes
1answer
48 views

Davies-Meyer Hash Function

So the Davies-Meyer Hash Function is: Hi = Hi−1 ⊕ exi (Hi−1) Say I pick H0 = 1110 0011 And the message x1 = "5" or "0000 0101" Is this the correct way to compute H1? H1 = 1110 0011 ⊕ (0000 0101 ⊕ ...
2
votes
2answers
153 views

What, cryptographically speaking, is a “long message”?

I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message". Also, do long message attacks only apply ...
0
votes
1answer
121 views

RC4 encryption/ decryption with hashing

I am working on RC4 encryption/ decryption algorithm based on the following: A wants to send M to B, for that A did: H = Hash (K||M) C = Ek (M||H) A sent ...
0
votes
1answer
67 views

How do I safely anonymize/hash a unique identifier to protect privacy?

I am building a system to collect a unique identifier (MAC addresses from 802.11 probe requests). The system will have several collection points over a large area, submitting to a central database. I ...