A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
6
votes
1answer
957 views
How does a birthday attack on a hashing algorithm work?
A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits.
That means it takes about ...
5
votes
2answers
1k views
Use of salt to hash a password
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
4
votes
1answer
190 views
Length of data to hash for PGP
I have finally managed to verify some simple PGP signed message blocks. However, I discovered that for some reason, my implementation limits me to verifying data that is 9-16 bytes long. no less. no ...
6
votes
2answers
334 views
Is bcrypt better than GnupPG's iterated+salted hashing method?
GnuPG has slow hash built-in in form of iterated+salted S2K.
Does it have disadvantages in comparance with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
1
vote
4answers
291 views
Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
I have a scenario similar to the one described in Wikipedia: hash list, but with a twist. I'm looking for a cryptographically secure hash function that would create the same root hash for the same ...
2
votes
1answer
136 views
Signing 14 bytes of data
for an embedded device I need to sign a 14-byte string and want to verify that string on the device.
Since there is already an AES-Library on the device, I thought about using the following scheme:
...
4
votes
2answers
221 views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = ...
15
votes
3answers
224 views
What differentiates a password hash from a cryptographic hash besides speed?
I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ...
11
votes
2answers
1k views
“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?
In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm?
Similarly, what is the security difference ...
3
votes
3answers
244 views
Multiple Hash Functions that work in either nesting
Are there any hashing functions that, if two are used in conjunction (with the same salts) will return the same response regardless of ordering?
I.e. are there hash-functions $H_1$, $H_2$ such that ...
0
votes
2answers
154 views
Idea for user/pass hashing to prevent rainbow tables, would it work?
I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ...
2
votes
1answer
168 views
Is there a known vulnerability when using identical key and salt with PBKDF2?
For optimum security, a random salt should be chosen for PBKDF2.
I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...
6
votes
1answer
94 views
Abstracting primitives and modes of operation
I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ...
4
votes
4answers
187 views
Asymmetric algorithm to generate compact unique messages that can be validated
I have a cryptographic problem with the following characteristics:
I need to generate a set of relatively short messages; say 20 bytes in length
The contents of the messages themselves is not ...
1
vote
3answers
200 views
Getting started [closed]
I'm looking for a good place to start in cryptography and places to go to get free books etc on the topic.
I have been looking online but I always get stuck at some point or another. I need something ...
13
votes
2answers
524 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
2
votes
1answer
93 views
Why are there $ signs in my passwd file?
I am trying to get access to my eReader and I managed to get the passwd file.
...
2
votes
2answers
706 views
Digital Signatures, Standard Hash Functions and MACs
I'm studying Hash functions and Digital Signatures in sequence, and came up with some doubts about their usage.
First of all:
What is the difference between hashing a document and signing it?
And ...
2
votes
3answers
423 views
Hash function in PBKDF2
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
6
votes
4answers
1k views
Difference between encrypting something and hashing something
What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
1
vote
1answer
184 views
How to represent a 32-byte SHA2 hash in the shortest possible string?
I'm calculating a SHA2 hash of a certain sensitive key value. I need to store files on disk using this hash a directory path prefix. So lets say I hash the key value 150023, I get a 32-byte value ...
3
votes
2answers
398 views
How did LinkedIn “salt” all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
4
votes
2answers
607 views
Is HMAC-DRBG or Hash-DRBG stronger?
Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90 (i.e. based on hash functions), which one is cryptographically stronger?
Hash-DRBG (Section 10.1.1)
...
3
votes
1answer
223 views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
4
votes
1answer
221 views
OpenPGP Signature Packet hashed data
RFC 4880 describes the version 4 signature packet, tag 2, as
...
1
vote
1answer
180 views
“Signing” with public key
For this question, the following caveats and assumptions hold:
There exists a 2048-bit RSA key pair used exclusively for signing/verification
The private key is kept completely private
There exists ...
5
votes
3answers
913 views
In the SHA hash algorithm, why is the message always padded?
In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s.
Why is it ...
6
votes
2answers
235 views
Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant Merkle–Damgård hash function $\mathcal{H}$ (e.g. SHA-1, RIPEMD-160, SHA-256, SHA-512). We define a Message Authentication Code $\mathcal{C}$
$$(k,m) ...
9
votes
2answers
316 views
Is every output of a hash function possible?
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? If so, what guarantees ...
9
votes
1answer
184 views
Which MACs can be converted into a secure unkeyed hash function?
It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
1
vote
0answers
60 views
Applying multiple hash functions to improve security? [duplicate]
Possible Duplicate:
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
I'm a total newb to cryptography but after reading what I've read about it, I had a ...
5
votes
4answers
991 views
What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?
If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
6
votes
2answers
374 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
1
vote
2answers
233 views
Real life collision when only using truncated hash
For MD5 two different inputs are known that produce the same 128 bit hash value. However, these inputs are artificially created for this specific purpose.
For normal, real life inputs I believe no ...
4
votes
1answer
480 views
Do Rabin Fingerprints have any advantages over CRC?
Background
In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows:
Rabin ...
2
votes
2answers
181 views
Order of hashing concatenation
A = hash("blue" + X);
B = hash("pink" + X);
If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()? ...
5
votes
1answer
155 views
One-way hash on encrypted data, result hidden from hasher
I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
3
votes
3answers
459 views
Why hash or salt when signing?
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV.
Why is that needed?
6
votes
1answer
543 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
2
votes
1answer
124 views
Question about hash collisions
If we have a hash function $h(x)$ and then a hash function $H(X) = h(h(X_0) || h(X_1))$ where $X_0$ is the first half of $X$, $X_1$ is the second half of $X$ and $||$ is concatenation. Then assuming ...
9
votes
4answers
423 views
Can you make a hash out of a stream cipher?
A comment on another question made me wonder about something:
Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
3
votes
1answer
122 views
DIfferent inner and outer hash functions for NIST Recommended HMAC?
The NIST recommended HMAC uses
$$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$
Is it ...
5
votes
2answers
204 views
Is there a hash algorithm that is slow to calculate but relatively fast to check?
Or more generally, is there a function or algorithm that is slow to calculate/execute, has a reliable execution time, and has a result that can be tested much more quickly than the calculation took?
1
vote
0answers
190 views
Openssl implementation of improved sha1 hashing [closed]
I want to use the improved sha1 hashing algorithm from the Intel blog described here Intel sha1 hashing. Currently I am using Openssl sha1 hashing in my application.
I wanted to know if anybody has ...
4
votes
2answers
209 views
Cost of attacking Mobile OTP with a fake server
You want to obtain a 74-bit secret $K$. There is an oracle that will provide you with the following value for several values of $T$:
...
4
votes
2answers
543 views
128 bit hash with least chance of collision
I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
1
vote
2answers
437 views
Why do all hash functions use big-endian data?
I've looked at several hash function specifications, and they all emphasize the need for big-endian byte ordering. Is there a reason for this that has to do with security, or is it simply convention?
4
votes
1answer
363 views
How is BCrypt secure when it uses a static dataset for blowfish hashing?
I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and ...
7
votes
2answers
241 views
What is the purpose of using different hash functions for the leaves and internals of a hash tree?
I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
5
votes
1answer
336 views
How does a “Tiger Tree Hash” handle data whose size isn't a power of two?
Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two.
...
