# Tagged Questions

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

303 views

### Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings:  \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto \left\{0,...
1k views

### Webapp password storage: Salting a hash vs multiple hashes?

For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ...
240 views

### Can the SHA256 hashes of consecutive integers be attacked?

Suppose that the attacker knows the SHA256 values of integers $n, n+1, n+2 ... n+k$. $n$ is sufficiently big, so we do not expect to be able to brute force $n$ just by $\operatorname{SHA256}(n)$ ...
408 views

I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target $... 1answer 1k views ### Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure? The Davies-Meyer compression function$h(H, m) = E_m(H) \oplus H$is said to be secure. So too is the Miyaguchi-Preneel compression function$h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ... 1answer 448 views ### Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate] First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ... 1answer 26k views ### What are the differences between a digital signature, a MAC and a hash? A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed? 7answers 37k views ### Are there two known strings which have the same MD5 hash value? Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")? 2answers 12k views ### “SHA-256” vs “any 256 bits of SHA-512”, which is more secure? In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm? Similarly, what is the security difference ... 1answer 4k views ### What is a “freestart collision”? In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ... 3answers 1k views ### Getting started [closed] I'm looking for a good place to start in cryptography and places to go to get free books etc on the topic. I have been looking online but I always get stuck at some point or another. I need something ... 3answers 2k views ### Why does SHA-1 have 80 rounds? Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds? 2answers 936 views ### Is bcrypt better than GnupPG's iterated+salted hashing method? GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparance with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs? 5answers 2k views ### How can rainbow tables be used for a dictionary attack? I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ... 3answers 434 views ### What differentiates a password hash from a cryptographic hash besides speed? I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ... 2answers 1k views ### Will repeated rounds of SHA-512 provide random numbers? If I hash a keyword with SHA-512 and then feed the output as the key for the next round ....and keep repeating this process, will I gather a stream of random numbers? 2answers 1k views ### Is SipHash cryptographically secure? I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks. SipHash seems ... 2answers 250 views ### How is HMAC(message,key) more secure than Hash(key1+message+key2) I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ... 2answers 818 views ### What is the purpose of using different hash functions for the leaves and internals of a hash tree? I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ... 3answers 691 views ### Is it safe to use file's hash as IV? I'm encrypting some files using AES in CBC mode. I'm also using file's digest (SHA-1) to check that data is decrypted correctly (so I need to store it with file). Is it safe to use this digest as ... 2answers 1k views ### Are AES-256's related-key weaknesses exploitable if it is used to build a hash? Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ... 3answers 659 views ### Counter mode secure hash algorithm Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. ... 2answers 2k views ### Use of salt to hash a password In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ... 1answer 960 views ### How does a “Tiger Tree Hash” handle data whose size isn't a power of two? Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two. ... 2answers 544 views ### Is SHA-1 still practically secure under specific scenarios? It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algebraic construction. The ... 1answer 1k views ### Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures) I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ... 4answers 622 views ### Does MD5 generate 128 independent bits? I heard that there are 128 stochastically independent bits in an MD5 output. Is that true? If so, are there any citations or proofs for that? 1answer 830 views ### Why are these specific values used to initialise the hash buffer in SHA-512? I'm reading the book Network Security Essentials written by William Stallings. To create a message digest with SHA-512, we have to go through some steps: append padding bits. append length ... 2answers 512 views ### Definition of “pepper” in hash functions I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, a ... 1answer 675 views ### Why are the initial states of hashes functions (like SHA-1) often non-zero? There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ... 1answer 228 views ### Can Skein be used as a secure MAC in format H(k || m)? Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ... 3answers 369 views ### Associative standard cryptographic hash function I am looking for a standard hash function which satisfies the following property: A hash function$H(a,b) = F(h(a),h(b))$with$h$(within$F$) any standard cryptographic hash function and$F$an ... 3answers 3k views ### What is the difference between a HMAC and a hash of data? On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data. What exactly is the difference between an HMAC and a hash of a ... 2answers 4k views ### Using a Hash as a secure PRNG I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ... 4answers 2k views ### Constructing a block-cipher from a hash function It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it ... 2answers 806 views ### Are cryptographic hash functions perfect hash functions? For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ... 4answers 891 views ### Compare two hashes with different salt I'm storing the salted hash of a credit card number in a database. What I'd like to be able to do is determine if two different entries in the same database correspond to the same credit card. ... 1answer 367 views ### Does salt size affect password hash security? I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ... 1answer 823 views ### Recommended way of adding a pepper/secret key to password before hashing? There have been several questions regarding password hashing here and on Security.SE. A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing ... 3answers 505 views ### SHA256 output to 0-99 number range? Is it mathematically possible to take a SHA256 hash and turn it into a 0-99 number where each number in 0-99 range is equally likely to be picked? As a 256 bit hash means the highest value possible ... 1answer 470 views ### Should HMAC or NMAC or plain Keccak be used for a secure MAC? After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ... 1answer 774 views ### Will rehashing an SHA256 hash continually, eventually produce every possible value? So let's say you had infinite time and energy. You have a hashed string of some sort. Because you have infinite time and energy, you can produce a collision(or the original value) easily enough. But, ... 1answer 1k views ### What happens to the entropy of a password when you hash it? For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5? 1answer 346 views ### Formula for the number of expected collisions Say we have a hash function that produces$n$bit outputs. From the birthday problem that after around$\sqrt{2^n}$different inputs to the has function, we can expect a collision. Say instead that ... 1answer 168 views ### Are ideal hashes possible to create? In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve). Hence, isn't it ... 1answer 2k views ### Why does Openssh use only SHA1 for signing and verifying of digital signatures? I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ... 1answer 267 views ### Why are there$ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
417 views

### Why is feed-forward mechanism used in hash functions?

The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...