A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (2)

5
votes
1answer
395 views

I need a 64-bit cryptographic hash for 96 bits of data

I have a situation in which I need to combine a 32-bit datum, G, and a 64-bit datum, I, to produce a 64-bit datum. No two ...
5
votes
1answer
245 views

HMAC construction based on the combination of two hash functions

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of ...
5
votes
1answer
313 views

md5: is reverse length-extension attack possible?

If I know H = md5( SECRET_KEY | DATA ) then I can calculate H' = md5( SECRET_KEY | DATA | DATA' ) That's length-extension ...
5
votes
1answer
428 views

OpenPGP Signature Packet hashed data

RFC 4880 describes the version 4 signature packet, tag 2, as ...
4
votes
2answers
286 views

Brute-force attack given small search-space and hash prefix

Suppose we have a value $secret which is a random 56-bit (7-byte) string. Suppose an adversary wishes to discover $secret. The ...
4
votes
1answer
697 views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = ...
4
votes
2answers
447 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
4
votes
1answer
187 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
4
votes
3answers
738 views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
3
votes
1answer
126 views

Partial hash code protocol for security tokens providing signatures

I've read the following two sentences within a beta protocol specification, which references ISO/IEC 7816-8 for PSO:HASH which already contains notions of a "partial hash". The off-card entity is ...
3
votes
5answers
2k views

Using one-way hash functions as the encryption method

Suppose two parties want to communicate securely with each other (Bob and Alice) using a simple messaging system in English. There are approximately 180,000 currently used words in the English ...
3
votes
1answer
950 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
2
votes
1answer
63 views

Formula for the number of expected collisions

Say we have a hash function that produces $n$ bit outputs. From the birthday problem that after around $\sqrt{2^n}$ different inputs to the has function, we can expect a collision. Say instead that ...
2
votes
2answers
74 views

Is Checksum to file back decoding possible?

So, I was having this weird thought. If the checksums(MD5 or SHA...) are unique to any file and are modified if any part of the file is edited, why cant the checksums be decoded back to get the ...
2
votes
5answers
540 views

Can hashing become encrypting?

hashing some data and encrypting data share some similar attributes. Surely this is why "Difference between encrypting something and hashing something" has been asked. The point of this question is ...
2
votes
1answer
305 views

distribution for a subset of md5

I need to uniquely assign a 32 bit integer to a collection of human readable strings (i.e. they will not be generated with hash collision in mind). I don't expect more than a few thousand strings. I ...
2
votes
1answer
323 views

Is this an acceptable implementation of ARC4 encryption for my system?

I am building an open source hardware system that will be used to control things over the internet. The system consists of a Base Station and Modules which use wireless communication at 2.4GHz to ...
2
votes
3answers
221 views

Why can't hashes be reversed with toffoli gates?

This is a follow up question to this question: Crack cryptographic hash functions using Toffoli gates?. Suppose there is a hash function $$H(x)=y,$$ where $x$ is the input of the function and $y$ is ...
2
votes
2answers
532 views

Difference between collision resistance and target collision resistance

For a hash function, what's the difference between Collision Resistance and Target Collision Resistance?. I understand the definition of hash function collision resistance, but I don't know about ...
2
votes
2answers
277 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
2
votes
3answers
800 views

Using Whirlpool hashing function to encrypt data

I've read that the Whirlpool hash function can produce footprints that could be used as a pseudorandom generator. Is it "OK" to use it to encrypt some data using something like the following? ...
2
votes
2answers
410 views

Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm?

I have constructed a stream cipher from a secure hash algorithm and a HMAC. Here is a brief description of the algorithm: Let: (Actually Objective-C styled pseudo code) ...
2
votes
2answers
338 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
2
votes
0answers
126 views

How hard is a known prefix hash preimage attack?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
2
votes
1answer
534 views

Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
2
votes
3answers
571 views

reverse of md5sum

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size N whose md5sum is X? For example, ...
2
votes
4answers
354 views

Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list

I have a scenario similar to the one described in Wikipedia: hash list, but with a twist. I'm looking for a cryptographically secure hash function that would create the same root hash for the same ...
1
vote
1answer
64 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
1
vote
1answer
63 views

SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)

The hashing scheme SHA-256 (for instance) is based on Merkle-Damgard construction with the underlying compression function based on the block cipher SHACAL-2 configured in Davies Meyer mode. SHACAL-2 ...
1
vote
1answer
186 views

Security of chameleon hash functions

With the knowledge of the trapdoor, we are able to compute the same digest for differents messages. I've read that given two messages $m$, $m'$ and two numbers $r$, $r'$ such that ...
1
vote
0answers
79 views

Are partial hashes used in cryptographic protocols?

In my question (and answer) about a partial hash code used within a signature application I found out that partial hash codes are sometimes used within protocols with a relatively restricted security ...
1
vote
1answer
198 views

SHA1 collision event probability after n iterations

There are String1 and String2 - some variables-strings. The probability of collision for different ...
1
vote
0answers
70 views

Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
1
vote
1answer
124 views

Does it make sense to stretch non-keys?

I was thinking about stretching salt. Key-stretching is good against brute force guessing and assumes your system isn't compromised. Salting a one-way makes it so you have to compute * n for each ...
1
vote
2answers
171 views

Does collision resistance stay when extending a hash function to a set domain?

Given a Cryptographic hash function $h$ for element $x$, let's extend it to sets via $H(S)=\prod_{x\in{S}}{h(x)}$. I am asking if the new hash $H$ (in domain of set) is still collision resistant? To ...
1
vote
2answers
324 views

Store hashed email and compare hash values

I have a number of different systems sending me email addresses, but I don't actually need the underlying email, just a hash of the email address. I know I can compare hash values to find matches ...
1
vote
1answer
188 views

Crack cryptographic hash functions using Toffoli gates?

Might it be possible that reversible combinatorial circuits (or some emulating software) are going to be used to get the input of the white box? I mean if I have constructed a proper reversible ...
0
votes
0answers
27 views

Can you find the search space? [duplicate]

Let A is a random number and has 512 bits.we make B from A and B has 1024 bits.Process of B is following: C=f(A) that f is hash and C has 160 bits.Then C pass in a parallel manner 7 different hash ...
0
votes
1answer
81 views

How can one generate pairs/triplets/…/n-ary MD5 collisions

Is there a way to generate n strings with the same MD5 hash?
0
votes
1answer
275 views

How Does Progressive Hashing Work?

Example: http://jsfiddle.net/KGtUE/ https://code.google.com/p/crypto-js/#Progressive_Hashing sha256.update("abc"); sha256.update("def"); sha256.update("ghi"); ...
0
votes
2answers
2k views

HMAC vs Encrypted Hash

What is best to use (for message integrity) between… AES(Data) + HMAC(Data) AES(Data + HMAC(Data)) AES(Data + Hash(Data)) …and why?
-1
votes
1answer
150 views

Reversing a Psuedo Crytographic Hash [closed]

I'm trying to get a better understanding of cryptographic hashing. Take the example transformation function below, is it possible to reverse this formula to solve/isolate for message[i]? ...