A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
-1
votes
2answers
152 views
What are alternatives to the random oracle model for modelling hash functions? [closed]
I was looking for more realistic alternatives to the ROM for describing hash functions in theoretical proofs. I came across the common reference string model (where hash functions can be modeled as ...
0
votes
1answer
58 views
Is there a problem with constructing a CSPRNG using MD5 or SHA1?
Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1? The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the ...
0
votes
1answer
80 views
Trapdoor implementation
Please refer to this secure index paper. On page#6, a trapdoor is defined as
...
1
vote
2answers
101 views
Store hashed email and compare hash values
I have a number of different systems sending me email addresses, but I don't actually need the underlying email, just a hash of the email address. I know I can compare hash values to find matches ...
2
votes
2answers
118 views
Commutativity of keyed hashes
Definition
${H_1}^{K_1}(X)$ means data $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$.
Short question
Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$?
Is ...
2
votes
0answers
54 views
How do you construct a practical full-domain hash function?
I am looking for practical constructions for Full Domain Hash.
I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a ...
4
votes
1answer
90 views
Why is feed-forward mechanism used in hash functions?
The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
1
vote
0answers
38 views
School exercise on untrusted channel comunication [duplicate]
Possible Duplicate:
Why is H(k||x) not a secure MAC construction?
I've the following problem:
two parties, A and B, share a secret key Kab.
M is a plaintext message, H an unkeyed hash ...
2
votes
2answers
174 views
Hashing passwords with a salt - why use different salt for everyone?
Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
-2
votes
1answer
60 views
Cryptographic Primitive Method
Is there any cryptographic primitive bijective (one-to-one and onto) function for creating cryptographic tools like symmetric encryption/decryption, Hash code generator, MAC, HMAC and Random number ...
2
votes
1answer
90 views
Hashing a password with the password?
I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
3
votes
2answers
116 views
How does using salt reduce rainbow table attack?
I could create a rainbow table for a particular salt value and still create a successful attack similar to one without salt value.
1
vote
1answer
100 views
Finding a collision for a hash function
I'm trying to find a collision for the following (modified) Merkle-Damgard hash function.
Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
0
votes
4answers
219 views
Is the One Time Pad (OTP) considered a cryptographic hash function?
As the title states, would the One Time Pad (OTP) be considered a cryptographic hash function?
4
votes
2answers
159 views
Is it possible to break a hash-based block cipher?
Let's define the following block cipher:
$C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
5
votes
1answer
139 views
How secure is the knapsack?
Can the knapsack be used in cryptography in a secure sense (described below)?
Knapsack problem: Given some number $X$ and a set $W$ of weights $w_1, w_2, ... w_n$, find a subset $S$ of $W$ (if it ...
4
votes
1answer
146 views
Why xor the message into the state for sponge hashes?
Sponge hashes like Keccak(SHA-3) and CubeHash, xor a message block into part of the internal state. Why use a reversible operation like xor for that, instead of replacing that part of the state with ...
2
votes
1answer
287 views
Example Rainbow Table Generation
I have read up on rainbow tables and think I understand the idea behind them. However, I find that it would be better for me to actually attempt to implement a (very basic) rainbow table generator in ...
3
votes
2answers
334 views
Difference between symmetric and asymmetric hash function?
The Linux kernel supports symmetric and asymmetric hash functions. E.g. sha1, sha256, ...
See tcrypt.c and search for test_hash_speed and ...
4
votes
3answers
191 views
How many bits of hash are realistically needed for key verification?
Say I'm connecting to a web server secured with TLS but with a self-signed certificate. Accordingly, I call the owner of the server and ask him what SHA1 fingerprint he has.
He starts reading out the ...
1
vote
0answers
47 views
P-Complete hashes, hashing to a larger set
Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits).
Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
1
vote
2answers
197 views
Can one build a one-way function from AES?
We change the AES block cipher encryption:
we delete the key schedule algorithm
the user now provides a string of 1408 bits
we divide the string to 11 sub keys, and use them directly in the ...
2
votes
1answer
105 views
A question regarding relevance of vulnerability of MD5 when linking multiple records together
I have been studying a Supreme Court case "IMS Health vs Sorrel".
In this case a Friend of Court brief filled by "Electronic Privacy Information Center" states that use of MD5 hash function to link ...
3
votes
2answers
115 views
Good enough deterministic PRNG based on hashes
Lets say I have a seed named iv which has a decent amount of entropy.
Are there any glaring issues with the following?
First 64 bytes are generated by SHA512(iv)
Next 64 bytes are generated by ...
5
votes
1answer
151 views
Did Merkle invent cryptographic hashing?
Chapter II of Merkle's 1979 PhD thesis is titled "One Way Hash Functions." The chapter appears to be the first reference to cryptographic hashing. The chapter has no references. Is there an earlier ...
3
votes
1answer
184 views
A single password manager vs password generator/hash
I have been wondering about the options available for managing passwords. However, they all seem to fail if the master password is compromised (which isn't a big surprise).
On one hand you have ...
3
votes
1answer
404 views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
2
votes
1answer
143 views
Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle?
I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
5
votes
2answers
158 views
Is there any research on the problem of making a number more memorable to humans?
Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
1
vote
1answer
61 views
Ensuring integrity of a client side script
I want a script that is running on the client to compute a collision resistant hash and send it to a server. I need to ensure that the script which performs this hash is not altered in any malicious ...
3
votes
1answer
167 views
Exhausting the entropy of a hash function
In the case of password storage, consider the following:
I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
4
votes
4answers
263 views
How to prove membership of a list without disclosing the list members?
I'm designing a messaging system where the sender A sends a message m with a signature s to n Receivers.
A Receiver Ri should then be able to prove to a Verifier V that he is one of the receivers of ...
3
votes
2answers
108 views
Is there an advantage to storing keys split between several hashes?
I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please ...
3
votes
2answers
140 views
Looking for examples for “proof by reduction”
Im looking for examples for a proof by reduction. For example:
Let $A=(Gen, H)$ be a hash function. We define a new Hash function $A'=(Gen',H')$ with
Gen=Gen'
$H'_s(x)=H_s(H_s(x))$
It should be ...
2
votes
0answers
147 views
Does Keccak have an eTCR mode?
On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3):
...
3
votes
2answers
155 views
Is storing the hash of a key together with ciphertext encrypted with that key secure?
Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
0
votes
1answer
75 views
Does a break in a collision resistance property of a hash function by definition implies an attack at the first pre-image attack?
Is there a formal security proof in the shape of reduction that states that if an attacker manages to break the collision resistance property of a cryptographic hash function (a random oracle) he will ...
0
votes
0answers
50 views
why these specific values used to initialize ipad & opad in HMAC [duplicate]
Possible Duplicate:
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
I'm reading the book Network Security Essentials written by William Stallings.
in this book,in ...
1
vote
1answer
174 views
How do unkeyed hash functions (for MDCs) provide security?
Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
1
vote
1answer
136 views
Why are these specific values used to initialise the hash buffer in SHA-512?
I'm reading the book Network Security Essentials written by William Stallings.
To create a message digest with SHA-512, we have to go through some steps:
append padding bits.
append length
...
0
votes
0answers
70 views
Why do we always append padding bits in SHA-512? [duplicate]
Possible Duplicate:
In the SHA hash algorithm, why is the message always padded?
I'm reading the book Network Security Essentials written by William Stallings.
To create a message digest ...
2
votes
2answers
249 views
Why do we need Hash by key?
(i'm just trying to find what am I missing...)
Assuming John have a clear text message , he can create a regular hash ( like md5 , or sha256) and then encrypt the ...
0
votes
1answer
84 views
Slow hash algorithm that does not require salt?
I usually choose bcrypt when hashing as I can set the work factor to slow down the calculations of the hash. However, I have to keep a copy of the hash in order to verify it (since it includes the ...
2
votes
2answers
294 views
Constructing a block-cipher from a hash function
It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it ...
1
vote
1answer
124 views
Crack cryptographic hash functions using Toffoli gates?
Might it be possible that reversible combinatorial circuits (or some emulating software) are going to be used to get the input of the white box?
I mean if I have constructed a proper reversible ...
0
votes
2answers
153 views
Finding partial pre-image of MD5 hash
I have the following requirement for hashing using MD5.
H(A,B,C,X);
Where values A,B & C are given. However X is not given.
I would like to find out what value of X would give a hash beginning ...
3
votes
4answers
146 views
Can there be two hash functions without common collisions?
Is there a way to prove/create (or are there known hash functions) two hash functions that never have the same collision? I mean, like provable in way that someone who took one cryptography class in ...
5
votes
2answers
181 views
Why does HOTP use such a complex truncate function?
In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes.
For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
1
vote
1answer
312 views
Crack SHA1 hash code
Given a set of SHA1 hash code, if we knew a portion of the plaintext for each particular hash code, and also the remaining portion of the plaintext is a constant value for each hash code.
Is it ...
-2
votes
1answer
170 views
Recovering SHA1 knowing 2/3 of the hash generated
I am doing some research on cryptography, so I generated a random string of numbers resembling a creditcard number(according to MOD10 validation) and encrypted it with SHA1 algorithm for encryption. ...
