A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
6
votes
4answers
1k views
Difference between encrypting something and hashing something
What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
6
votes
2answers
150 views
Finding hash almost-collisions
A few months ago, XKCD posted a challenge to find a plaintext which hashed (using Skein 1024 1024) to a specified value. Inputs were scored based on the hamming distance between the hash of the ...
6
votes
2answers
246 views
Key Length & Hashing
I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit.
I am using the SRP protocol for authentication (a ...
6
votes
1answer
102 views
Is SpookyHash vulnerable to HashDoS?
Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash?
My first uneducated guess is that it would be much harder to ...
6
votes
1answer
188 views
Using SHA-256 with different initial hash value
FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value ...
6
votes
2answers
374 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
6
votes
1answer
957 views
How does a birthday attack on a hashing algorithm work?
A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits.
That means it takes about ...
6
votes
1answer
543 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
6
votes
2answers
235 views
Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant Merkle–Damgård hash function $\mathcal{H}$ (e.g. SHA-1, RIPEMD-160, SHA-256, SHA-512). We define a Message Authentication Code $\mathcal{C}$
$$(k,m) ...
6
votes
1answer
275 views
Hash function from narrower block cipher operated in CBC-encryption mode?
I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
6
votes
1answer
197 views
Why does Skein use an output transform, but other similar hashes don't?
Skein uses an additional compression function call to finalize the output, even when the output isn't larger than the native output size.
The Skein paper says:
Due to Skein’s output ...
6
votes
1answer
94 views
Abstracting primitives and modes of operation
I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ...
5
votes
4answers
286 views
Does MD5 generate 128 independent bits?
I heard that there are 128 stochastically independent bits in an MD5 output. Is that true?
If so, are there any citations or proofs for that?
5
votes
2answers
204 views
Is there a hash algorithm that is slow to calculate but relatively fast to check?
Or more generally, is there a function or algorithm that is slow to calculate/execute, has a reliable execution time, and has a result that can be tested much more quickly than the calculation took?
5
votes
3answers
912 views
In the SHA hash algorithm, why is the message always padded?
In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s.
Why is it ...
5
votes
3answers
290 views
“Weaknesses” in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
5
votes
2answers
1k views
Use of salt to hash a password
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
5
votes
4answers
991 views
What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?
If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
5
votes
2answers
677 views
Strength of multiple hash iterations?
Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ...
5
votes
2answers
131 views
Can the hash of one message be used to make it easier to find the hash of a very similar message?
Background:
I am trying to get an understanding of using a hash of a passphrase as a secret.
Example:
...
5
votes
2answers
516 views
Accelerating SHA-1
I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
5
votes
2answers
158 views
Is there any research on the problem of making a number more memorable to humans?
Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
5
votes
2answers
181 views
Why does HOTP use such a complex truncate function?
In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes.
For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
5
votes
4answers
356 views
Creating an encryption key from several other keys and using hash functions
I want to combine two or more keys to create a single encryption key that relies on all of them. What is the proper method for doing that? Simple XOR? Using hash functions? Something else?
I ...
5
votes
1answer
335 views
How does a “Tiger Tree Hash” handle data whose size isn't a power of two?
Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two.
...
5
votes
1answer
308 views
What is the proper way to use a client nonce?
I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure:
Client's Site (CS) requests nonce from My App (MA), posting their username
MA verifies the ...
5
votes
1answer
139 views
How secure is the knapsack?
Can the knapsack be used in cryptography in a secure sense (described below)?
Knapsack problem: Given some number $X$ and a set $W$ of weights $w_1, w_2, ... w_n$, find a subset $S$ of $W$ (if it ...
5
votes
1answer
151 views
Did Merkle invent cryptographic hashing?
Chapter II of Merkle's 1979 PhD thesis is titled "One Way Hash Functions." The chapter appears to be the first reference to cryptographic hashing. The chapter has no references. Is there an earlier ...
5
votes
1answer
155 views
One-way hash on encrypted data, result hidden from hasher
I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
5
votes
1answer
135 views
Can a proof be constructed to show there is no distinguisher?
Let's assume a simple algorithm like the Skein hash function.
Is it possible, given the algorithm, to construct a proof that it does not have a particular distinguisher, something like:
$P(xyz)$ is ...
4
votes
3answers
542 views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
4
votes
4answers
500 views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. ...
4
votes
3answers
520 views
What is the recommended replacement for MD5?
Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
4
votes
4answers
196 views
What is the difference between a hash and a permutation?
As defined by Wikipedia a hash function is
[...] any algorithm or subroutine that maps large data sets of variable length to smaller data sets of a fixed length. For example, a person's name, ...
4
votes
2answers
159 views
Is SHA-1 still practical secure under specific scenarios?
It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algrebraic construction. ...
4
votes
2answers
187 views
Do MD5's weaknesses affect Oplop?
Oplop is an algorithm that generates account-specific passwords from a master password and user-chosen nickname (typically username@domain). From the website:
Concatenate the master password with ...
4
votes
4answers
213 views
How is it possible to parallelize a hashing function to crack an iteratively hashed password?
Suppose I have an algorithm that relies on multiple iterations of a hash function like SHA1 to slow down an attacker trying to bruteforce a hash.
...
4
votes
4answers
196 views
Could a very long password theoretically eliminate the need for a slow hash?
Before I provide details, I want to clarify that I am not looking to implement this practically, but I'm only asking to get a better understanding.
The way I currently understand it, we use slow ...
4
votes
3answers
147 views
Can I jettison MAC if I already have SHA1(M)?
I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...
4
votes
3answers
611 views
Do I have to recompute all hashes if I change the work factor in bcrypt?
The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
4
votes
2answers
606 views
Is HMAC-DRBG or Hash-DRBG stronger?
Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90 (i.e. based on hash functions), which one is cryptographically stronger?
Hash-DRBG (Section 10.1.1)
...
4
votes
1answer
306 views
From hash to Cryptographic hash
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
4
votes
2answers
159 views
Is it possible to break a hash-based block cipher?
Let's define the following block cipher:
$C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
4
votes
3answers
191 views
How many bits of hash are realistically needed for key verification?
Say I'm connecting to a web server secured with TLS but with a self-signed certificate. Accordingly, I call the owner of the server and ask him what SHA1 fingerprint he has.
He starts reading out the ...
4
votes
3answers
413 views
Is the number of creatable torrents limited?
Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
4
votes
1answer
245 views
Any point in waiting for the SHA-3 standard?
The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter?
That is, can we just assume it's going to be as specified by the submitters ...
4
votes
2answers
166 views
Why are the constants so simple in Keccak?
Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF)
The initial values of the state in Keccak is ...
4
votes
1answer
214 views
Why x00 is usually avoided in salt?
In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
4
votes
2answers
890 views
SHA-256 “midstate”
Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here.
The general concept is that Bitcoin ...
4
votes
4answers
264 views
Are derived hashes weakening the root?
Given a root hash
root = H(plaintext)
and two (or more) derived hashes
h1 = H(salt1 + root)
h2 = H(salt2 + root)
would the ...
