# Tagged Questions

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

565 views

### How is it possible to parallelize a hashing function to crack an iteratively hashed password?

Suppose I have an algorithm that relies on multiple iterations of a hash function like SHA1 to slow down an attacker trying to bruteforce a hash. ...
7k views

### understanding a length extension attack

I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
269 views

### Why does Skein use an output transform, but other similar hashes don't?

Skein uses an additional compression function call to finalize the output, even when the output isn't larger than the native output size. The Skein paper says: Due to Skein’s output ...
1k views

### Using SHA-256 with different initial hash value

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (...
1k views

### How to test distribution of a hash function?

From what I've found, it is generally accepted a cryptographic hash function like SHA-2 has an evenly, randomly distributed output. Is there a way to test this without running through the entire 2^...
334 views

### md5: is reverse length-extension attack possible?

If I know H = md5( SECRET_KEY | DATA ) then I can calculate H' = md5( SECRET_KEY | DATA | DATA' ) That's length-extension ...
689 views

### Is it safe to use file's hash as IV?

I'm encrypting some files using AES in CBC mode. I'm also using file's digest (SHA-1) to check that data is decrypted correctly (so I need to store it with file). Is it safe to use this digest as ...
530 views

### Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?

For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security? Note: I just want more secure output and CPU cycles does not ...
8k views

### No SHA-1 collision? Yet SHA-1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no than how can SHA-1 be considered broken?
389 views

### Secure Hash Function based on AES

How secure would a hash function be which appends an extra block of 16 zeroed out bytes to the end of the message and then AES-encrypts it with a well-known password (say the first 128 bits of pi) ...
745 views

### Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
7k views

### Are there hash algorithms with variable length output?

I understand that for example MD5 produces a 128 bit hash value from a given text of variable size. My question is if there is a hash-like algorithm that will produce a hash value where one can ...
1k views

### How to implement order preserving encryption or order preserving hashing [closed]

Does anybody know any free implementation of either order preserving encryption or order preserving hashing? I've found some codes like CMPH but I need to dynamically add new DATA and that's why most ...
296 views

### Do MD5's weaknesses affect Oplop?

Oplop is an algorithm that generates account-specific passwords from a master password and user-chosen nickname (typically username@domain). From the website: Concatenate the master password with ...
255 views

### Is stretching hash several times basically the same as bcrypt?

As I understand it, the main advantage of bcrypt is stretching so it becomes slower to crack overtime. But, is using a "good enough" algorithm (e.g., SHA-2 family) then stretching until it's slow ...
2k views

### Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
912 views

### Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
507 views

### Why x00 is usually avoided in salt?

In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
164 views

### Why do we need extra hashing if we could use simpler scheme?

Lets say that we use init vector IV, key K and HMAC key H. Message is M. Mode of operation is CBC !!! We usually encrypt this way: ...
300 views

### Should I use md5 for my new application?

MD5 is a very fast hash and its output is short and easy to store. Should I use it for my non-security-sensitive application? I don't think so, but I can't seem to convince anyone else that this is ...
828 views

### Adaptive Hash Functions: How to tell how many iterations were used?

If an adaptive hash function like bcrypt or PBKDF2 is used in hashing passwords, the number of iterations used in the hashing process can be configured. For a penetration tester or a malicious hacker,...
223 views

### Pseudo preimage for a hash made from a cipher

Consider the Miyaguchi–Preneel construction: $H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros) $H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$ where $E(K,M)$ is a block cipher (for ...
652 views

### Can I jettison MAC if I already have SHA1(M)?

I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...
8k views

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about $2^{... 2answers 508 views ### Can a “pattern” in a series of passwords be detected from their hashes (and maybe a single raw password)? Let's say I'm a lazy user of a system with annoyingly frequent password change policies. I may have a "good" password I used initially that is only used for this system but since I have to change it ... 2answers 933 views ### Is bcrypt better than GnupPG's iterated+salted hashing method? GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparance with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs? 2answers 1k views ### Is the encryption of a hash a good MAC? At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g.$s = \mathrm{hash}(k||\mathrm{data})$... 1answer 288 views ### Signing 14 bytes of data for an embedded device I need to sign a 14-byte string and want to verify that string on the device. Since there is already an AES-Library on the device, I thought about using the following scheme: ... 1answer 493 views ### Hash function from narrower block cipher operated in CBC-encryption mode? I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message$M$of fixed size$|M|=m\cdot b$... 3answers 433 views ### What differentiates a password hash from a cryptographic hash besides speed? I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ... 2answers 12k views ### “SHA-256” vs “any 256 bits of SHA-512”, which is more secure? In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm? Similarly, what is the security difference ... 2answers 274 views ### Idea for user/pass hashing to prevent rainbow tables, would it work? I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ... 3answers 580 views ### Multiple Hash Functions that work in either nesting Are there any hashing functions that, if two are used in conjunction (with the same salts) will return the same response regardless of ordering? I.e. are there hash-functions$H_1$,$H_2$such that ... 1answer 237 views ### Length of data to hash for PGP I have finally managed to verify some simple PGP signed message blocks. However, I discovered that for some reason, my implementation limits me to verifying data that is 9-16 bytes long. no less. no ... 4answers 2k views ### How can I validate a hashed password if all I have is another hash? The Scenario I have a client-side web application that bounces requests against a server-side API. For the sake of simplicity, every request must pass a username and password. This is similar to ... 2answers 163 views ### Abstracting primitives and modes of operation I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ... 4answers 686 views ### Asymmetric algorithm to generate compact unique messages that can be validated I have a cryptographic problem with the following characteristics: I need to generate a set of relatively short messages; say 20 bytes in length The contents of the messages themselves is not ... 3answers 1k views ### Getting started [closed] I'm looking for a good place to start in cryptography and places to go to get free books etc on the topic. I have been looking online but I always get stuck at some point or another. I need something ... 2answers 5k views ### What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do? Wikipedia lists the following pseudocode for HMAC: ... 3answers 3k views ### Do I have to recompute all hashes if I change the work factor in bcrypt? The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ... 4answers 6k views ### What is the recommended replacement for MD5? Since MD5 is broken for purposes of security, what hash should I be using now for secure applications? 1answer 267 views ### Why are there$ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
3k views

### Digital Signatures, Standard Hash Functions and MACs

I'm studying Hash functions and Digital Signatures in sequence, and came up with some doubts about their usage. First of all: What is the difference between hashing a document and signing it? And ...
17k views

### Difference between encrypting something and hashing something

What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
741 views

### How to represent a 32-byte SHA2 hash in the shortest possible string?

I'm calculating a SHA2 hash of a certain sensitive key value. I need to store files on disk using this hash a directory path prefix. So lets say I hash the key value 150023, I get a 32-byte value ...
1k views

### Hash function in PBKDF2

From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
642 views

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
447 views

### What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...