A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
4
votes
1answer
214 views
Why x00 is usually avoided in salt?
In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
4
votes
2answers
933 views
SHA-256 “midstate”
Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here.
The general concept is that Bitcoin ...
4
votes
4answers
264 views
Are derived hashes weakening the root?
Given a root hash
root = H(plaintext)
and two (or more) derived hashes
h1 = H(salt1 + root)
h2 = H(salt2 + root)
would the ...
4
votes
4answers
265 views
How to prove membership of a list without disclosing the list members?
I'm designing a messaging system where the sender A sends a message m with a signature s to n Receivers.
A Receiver Ri should then be able to prove to a Verifier V that he is one of the receivers of ...
4
votes
4answers
493 views
How can I validate a hashed password if all I have is another hash?
The Scenario
I have a client-side web application that bounces requests against a server-side API. For the sake of simplicity, every request must pass a username and password. This is similar to ...
4
votes
1answer
90 views
Why is feed-forward mechanism used in hash functions?
The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
4
votes
2answers
227 views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = ...
4
votes
4answers
191 views
Asymmetric algorithm to generate compact unique messages that can be validated
I have a cryptographic problem with the following characteristics:
I need to generate a set of relatively short messages; say 20 bytes in length
The contents of the messages themselves is not ...
4
votes
1answer
216 views
What's the difference between a Key Derivation Function and a Password-Hash?
It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
4
votes
1answer
363 views
How is BCrypt secure when it uses a static dataset for blowfish hashing?
I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and ...
4
votes
2answers
176 views
Can I use a key-derivation-function as the hash function H in SRP?
In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
4
votes
2answers
555 views
128 bit hash with least chance of collision
I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
4
votes
1answer
371 views
Is a second preimage attack on MD5 feasible?
What's the practical status of MD5 w.r.t. second-preimage?
Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
4
votes
1answer
221 views
OpenPGP Signature Packet hashed data
RFC 4880 describes the version 4 signature packet, tag 2, as
...
4
votes
1answer
488 views
Do Rabin Fingerprints have any advantages over CRC?
Background
In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows:
Rabin ...
4
votes
2answers
213 views
Cost of attacking Mobile OTP with a fake server
You want to obtain a 74-bit secret $K$. There is an oracle that will provide you with the following value for several values of $T$:
...
4
votes
1answer
148 views
Why xor the message into the state for sponge hashes?
Sponge hashes like Keccak(SHA-3) and CubeHash, xor a message block into part of the internal state. Why use a reversible operation like xor for that, instead of replacing that part of the state with ...
4
votes
1answer
190 views
Length of data to hash for PGP
I have finally managed to verify some simple PGP signed message blocks. However, I discovered that for some reason, my implementation limits me to verifying data that is 9-16 bytes long. no less. no ...
4
votes
0answers
87 views
Pseudo preimage for a hash made from a cipher
Consider the Miyaguchi–Preneel construction:
$H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros)
$H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$
where $E(K,M)$ is a block cipher (for ...
4
votes
0answers
279 views
SHA3 conference highlights? [closed]
Is there anyplace online that someone can find out a summary of some of the things that went on at the SHA3 conference on Mar 22-23?
3
votes
5answers
505 views
Is there a hash function with 2048bit output?
Is there a publicly available cryptographic hashing algorithm with 2048 bit output?
The standard ones are "only" up to 512 bit (SHA-512, WHIRLPOOL).
(2048 bits are 256 bytes, so it would be useful ...
3
votes
4answers
236 views
Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?
$H(s,r)=d$ is a function that hashes the secret string $s$ with a salt $r$, and returns a digest $d$.
$r$ may be arbitrarily chosen and each $r$ returns a different $d$.
For any $d$, $r$ is known from ...
3
votes
4answers
138 views
Turning a cipher into a hashing function
This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;)
The first hashing functions created ...
3
votes
2answers
338 views
Difference between symmetric and asymmetric hash function?
The Linux kernel supports symmetric and asymmetric hash functions. E.g. sha1, sha256, ...
See tcrypt.c and search for test_hash_speed and ...
3
votes
3answers
134 views
What is the difference between a HMAC and a hash of data?
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a ...
3
votes
2answers
150 views
Is a random length-extension worth the effort?
I'm conceiving an application that uses cryptographic tools and concepts for securing data. I know that's difficult and risky, therefore I prefer to ask around before implementing anything.
When ...
3
votes
2answers
117 views
Good enough deterministic PRNG based on hashes
Lets say I have a seed named iv which has a decent amount of entropy.
Are there any glaring issues with the following?
First 64 bytes are generated by SHA512(iv)
Next 64 bytes are generated by ...
3
votes
4answers
148 views
Can there be two hash functions without common collisions?
Is there a way to prove/create (or are there known hash functions) two hash functions that never have the same collision? I mean, like provable in way that someone who took one cryptography class in ...
3
votes
2answers
142 views
Can a “pattern” in a series of passwords be detected from their hashes (and maybe a single raw password)?
Let's say I'm a lazy user of a system with annoyingly frequent password change policies. I may have a "good" password I used initially that is only used for this system but since I have to change it ...
3
votes
2answers
188 views
toy hash algorithm
I'm looking for a toy hash function, where the idea is to have high school students break (i.e. find a collision) a hash function by hand, in order to teach them how one way functions and hashing ...
3
votes
1answer
430 views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
3
votes
4answers
910 views
How are timestamps verified?
You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
3
votes
3answers
856 views
Simple/beginner level explanation of salt
I'm a beginner to cryptography and looking to understand in very simple terms what salt is, when I might need to use it and why I should/should not use it. Can anyone offer me a very simple and clear ...
3
votes
2answers
142 views
Does the position of the salt improve its effectiveness when hashing?
Seems most documentation I have read suggests the salt should prefix the value to be hashed. Is this just for consistency, or is the salt more effective when prefixed?
3
votes
3answers
246 views
Multiple Hash Functions that work in either nesting
Are there any hashing functions that, if two are used in conjunction (with the same salts) will return the same response regardless of ordering?
I.e. are there hash-functions $H_1$, $H_2$ such that ...
3
votes
1answer
224 views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
3
votes
1answer
233 views
Do Cryptographic Hashing Algorithms operate only on Integers?
Do all the Cryptographic hashing algorithms operate only on integers (32 bit or 64 bit)? Is there any operation performed on Floating Point Numbers as well?
The reason I ask this is because I read ...
3
votes
2answers
155 views
Is storing the hash of a key together with ciphertext encrypted with that key secure?
Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
3
votes
2answers
1k views
Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509
What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"?
Edit:
I'm creating the ...
3
votes
1answer
136 views
Is a using salt important when creating a hash data validator?
I am creating a service that will return an set of objects, which will be used by multiple systems. At the end of the process, one (or more) of the objects will be sent back to our system for ...
3
votes
1answer
131 views
Using an MD5 hash as a password
Suppose Alice is using a password prompt that only accepts up to 32 characters for any particular password.
Memorization of long strings of random characters is not one of Alice's strengths, so she ...
3
votes
2answers
122 views
RSA digital signature vs authenticated cipher
I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).
I plan to encrypt the data using AES, which will cover the confidentiality requirement.
So ...
3
votes
1answer
172 views
Exhausting the entropy of a hash function
In the case of password storage, consider the following:
I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
3
votes
2answers
108 views
Is there an advantage to storing keys split between several hashes?
I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please ...
3
votes
2answers
140 views
Looking for examples for “proof by reduction”
Im looking for examples for a proof by reduction. For example:
Let $A=(Gen, H)$ be a hash function. We define a new Hash function $A'=(Gen',H')$ with
Gen=Gen'
$H'_s(x)=H_s(H_s(x))$
It should be ...
3
votes
2answers
402 views
How did LinkedIn “salt” all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
3
votes
3answers
469 views
Why hash or salt when signing?
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV.
Why is that needed?
3
votes
2answers
229 views
Malleability of ElGamal and Hashed ElGamal
Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
3
votes
3answers
626 views
How can I create a fixed length output in my hash function?
I've been recently looking into the creation (and theory) of hash functions, however I just can't figure out how to turn a message into something of a fixed length.
At the moment, my theory of a hash ...
3
votes
1answer
162 views
Is the last step of an iterated cryptographic hash still as resistant to preimage attacks as the original hash?
Considering a cryptographic hash, such as MD5 or SHA2, denoted by the function $H(m)$ where $m$ is an arbitrary binary string, there is a lot of material available that deals with potential weakness ...
