A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
4
votes
2answers
204 views
Are cryptographic hash functions perfect hash functions?
For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ...
2
votes
2answers
136 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
1
vote
1answer
61 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
2
votes
0answers
72 views
How can I prove that this encryption scheme from a random oracle is secure?
I am reading this example:
A random oracle is an ideal object.
What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
1answer
106 views
How to use salt if I am sending hashed password?
If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
4
votes
1answer
250 views
Any point in waiting for the SHA-3 standard?
The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter?
That is, can we just assume it's going to be as specified by the submitters ...
0
votes
2answers
79 views
Using salted hash as password for easy memorization without reuse?
I had an idea earlier:
Secure passwords are a) long, and b) unpredictable. A hash is both of these. Would it be safe to reuse a key between sites, and include the site's name as a salt? For example:
...
4
votes
2answers
187 views
Why are the constants so simple in Keccak?
Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF)
The initial values of the state in Keccak is ...
6
votes
3answers
535 views
What security does Keccak offer against quantum attacks, specifically Grover's algorithm?
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:
Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second ...
5
votes
0answers
61 views
MD4 First preimage - state of the art
What's the state of the attack to get the first preimage on MD4?
Is it still this http://www.di.ens.fr/~leurent/files/MD4_FSE08.pdf in 2^102 ?
5
votes
3answers
338 views
“Weaknesses” in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
2
votes
2answers
143 views
How can mega store my login details and still be secure?
I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works:
Upon first signing up for an account you make a ...
1
vote
1answer
74 views
What's the difference between “HashX-512” and “HashX-1024”?
I need to make a Skein hash's, specifically, Skein-1024; however, I only have access currently to Skein-512. Is there any way to utilize a Skein-512 function to get the result of a Skein-1024 hash?
...
3
votes
2answers
140 views
RSA digital signature vs authenticated cipher
I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).
I plan to encrypt the data using AES, which will cover the confidentiality requirement.
So ...
6
votes
1answer
113 views
Is SpookyHash vulnerable to HashDoS?
Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash?
My first uneducated guess is that it would be much harder to ...
4
votes
4answers
215 views
What is the difference between a hash and a permutation?
As defined by Wikipedia a hash function is
[...] any algorithm or subroutine that maps large data sets of variable length to smaller data sets of a fixed length. For example, a person's name, ...
4
votes
4answers
202 views
Could a very long password theoretically eliminate the need for a slow hash?
Before I provide details, I want to clarify that I am not looking to implement this practically, but I'm only asking to get a better understanding.
The way I currently understand it, we use slow ...
26
votes
2answers
2k views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
1
vote
1answer
49 views
Selecting a large NUMS Safe prime
Suppose I want to use the following simple hash function.
For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation).
This ...
5
votes
2answers
188 views
Can I use a key-derivation-function as the hash function H in SRP?
In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
4
votes
4answers
519 views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. ...
0
votes
0answers
54 views
Strength of Combining Hash functions [duplicate]
If I combine two hash functions, what will the impact on the strength of the resulting function.
If I combine in following way:
H1*H2 (multiply)
H1 + H2 (concat)
H1 Xor H2
H1 (H2)
EDIT:
Lets say H1 ...
6
votes
3answers
409 views
Counter mode secure hash algorithm
Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. ...
1
vote
0answers
70 views
Is SHA-1 collision free on data up to 20 bytes long? [duplicate]
Is SHA-1 collision free on data up to 20 bytes long (lenght of hash / internal state)? That means that every input produce unique output, but you surely know that, i just write it in order my question ...
4
votes
2answers
169 views
Is SHA-1 still practical secure under specific scenarios?
It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algrebraic construction. ...
6
votes
1answer
197 views
Can I find two specific words with the same md5 hash?
I want to find two strings containing special words like "yes" or "no", mixed with random characters, for which the MD5 hash is equal.
An example of what I'm looking for:
...
3
votes
3answers
138 views
What is the difference between a HMAC and a hash of data?
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a ...
3
votes
4answers
143 views
Turning a cipher into a hashing function
This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;)
The first hashing functions created ...
4
votes
1answer
355 views
From hash to Cryptographic hash
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
0
votes
0answers
36 views
How hard is a known prefix hash preimage attack?
Suppose the attacker knows X, Z such that
H(X || Y) = Z
If bit-length(Y) < 60 then a brute force attack is possible.
What if
bit-length(Z) = 256 (such as in SHA-256)
bit-length(X) = 128
...
1
vote
0answers
41 views
Is there a way to analyse xxHash and tell, either by human analysis, or with an automated tool, that this hash function is or is not cryptographic? [duplicate]
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for Internet usage, due to a certain type of DDos attack ...
2
votes
2answers
213 views
what kind of hash function can provide a short hash and be collision resistant?
When you try to connect via SSH, you see a signature which is short but I heard it is even stronger than sha256. It is perhaps stronger because it uses more rounds. Is there a hash function or a ...
0
votes
0answers
69 views
MD5 > Would multiple hashings increase security? [closed]
A Simple question,
if i run a string trough the standard md5 encryption function multiple times, does it increase security the more i do it? does it protect against rainbow tables? etc.
5
votes
2answers
133 views
Can the hash of one message be used to make it easier to find the hash of a very similar message?
Background:
I am trying to get an understanding of using a hash of a passphrase as a secret.
Example:
...
-1
votes
2answers
159 views
What are alternatives to the random oracle model for modelling hash functions? [closed]
I was looking for more realistic alternatives to the ROM for describing hash functions in theoretical proofs. I came across the common reference string model (where hash functions can be modeled as ...
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
2
votes
2answers
121 views
Commutativity of keyed hashes
Definition
${H_1}^{K_1}(X)$ means data $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$.
Short question
Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$?
Is ...
0
votes
1answer
86 views
Trapdoor implementation
Please refer to this secure index paper. On page#6, a trapdoor is defined as
...
1
vote
2answers
122 views
Store hashed email and compare hash values
I have a number of different systems sending me email addresses, but I don't actually need the underlying email, just a hash of the email address. I know I can compare hash values to find matches ...
2
votes
0answers
59 views
How do you construct a practical full-domain hash function?
I am looking for practical constructions for Full Domain Hash.
I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a ...
4
votes
1answer
98 views
Why is feed-forward mechanism used in hash functions?
The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
1
vote
0answers
41 views
School exercise on untrusted channel comunication [duplicate]
Possible Duplicate:
Why is H(k||x) not a secure MAC construction?
I've the following problem:
two parties, A and B, share a secret key Kab.
M is a plaintext message, H an unkeyed hash ...
2
votes
2answers
190 views
Hashing passwords with a salt - why use different salt for everyone?
Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
-2
votes
1answer
62 views
Cryptographic Primitive Method
Is there any cryptographic primitive bijective (one-to-one and onto) function for creating cryptographic tools like symmetric encryption/decryption, Hash code generator, MAC, HMAC and Random number ...
2
votes
1answer
90 views
Hashing a password with the password?
I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
2
votes
5answers
709 views
Are there hash algorithms with variable length output?
I understand that for example MD5 produces a 128 bit hash value from a given text of variable size. My question is if there is a hash-like algorithm that will produce a hash value where one can ...
1
vote
1answer
103 views
Finding a collision for a hash function
I'm trying to find a collision for the following (modified) Merkle-Damgard hash function.
Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
3
votes
2answers
131 views
How does using salt reduce rainbow table attack?
I could create a rainbow table for a particular salt value and still create a successful attack similar to one without salt value.
7
votes
3answers
317 views
Is it safe to use file's hash as IV?
I'm encrypting some files using AES in CBC mode.
I'm also using file's digest (SHA-1) to check that data is decrypted correctly (so I need to store it with file).
Is it safe to use this digest as ...
0
votes
4answers
230 views
Is the One Time Pad (OTP) considered a cryptographic hash function?
As the title states, would the One Time Pad (OTP) be considered a cryptographic hash function?
