A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (2)

7
votes
2answers
726 views

Key Length & Hashing

I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit. I am using the SRP protocol for authentication (a ...
7
votes
3answers
4k views

The difference between being not strongly collision resistant, and not weakly collision resistant?

So I understand the two concepts: (Strong) collision resistance: it is infeasible to find a pair $x \neq x'$ such that $h(x) = h(x')$ Weak collision resistance / 2nd-preimage resistance: for all $x \...
7
votes
4answers
686 views

Asymmetric algorithm to generate compact unique messages that can be validated

I have a cryptographic problem with the following characteristics: I need to generate a set of relatively short messages; say 20 bytes in length The contents of the messages themselves is not ...
7
votes
1answer
2k views

Using an MD5 hash as a password

Suppose Alice is using a password prompt that only accepts up to 32 characters for any particular password. Memorization of long strings of random characters is not one of Alice's strengths, so she ...
7
votes
2answers
604 views

Finding hash almost-collisions

A few months ago, XKCD posted a challenge to find a plaintext which hashed (using Skein 1024 1024) to a specified value. Inputs were scored based on the hamming distance between the hash of the ...
7
votes
3answers
912 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
7
votes
1answer
1k views

Why doesn't preimage resistance imply the second preimage resistance?

Let the preimage resistance be defined as »given a hash value $h$, it is hard to find any message $m$ such that $\operatorname{hash}(m)=h$«, and let the second preimage resistance be defined as »given ...
7
votes
1answer
246 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
7
votes
1answer
2k views

Commitment scheme using hash functions

Let's say Alice and Bob are playing a game where Bob is trying to guess a number Alice has chosen. Alice chooses a key $K$ and a number $N$ at random and performs $C=Commit(K, N)$ where $Commit(K, N)=...
7
votes
2answers
134 views

Would it matter if my miner was hashing random vs incremental values?

I'm working on my miner for my "game" site that's basically a pre-image attack from a hash posted online. You submit a hash input, it's hashed, and your score is the hamming distance (the number of ...
7
votes
1answer
588 views

Is SpookyHash vulnerable to HashDoS?

Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash? My first uneducated guess is that it would be much harder to ...
7
votes
1answer
1k views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
7
votes
1answer
959 views

How does a “Tiger Tree Hash” handle data whose size isn't a power of two?

Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two. ...
7
votes
1answer
221 views

Can a proof be constructed to show there is no distinguisher?

Let's assume a simple algorithm like the Skein hash function. Is it possible, given the algorithm, to construct a proof that it does not have a particular distinguisher, something like: $P(xyz)$ is ...
7
votes
1answer
522 views

OpenPGP Signature Packet hashed data

RFC 4880 describes the version 4 signature packet, tag 2, as ...
7
votes
1answer
61 views

Difficulty to find any preimages $a$ and $b$ for given $V$ so that $H(a) \oplus H(b) = V$?

Suppose I have the values $a$, $b$, and $V = H(a) \oplus H(b)$ with inputs $a \neq b$ and $H$ being SHA-224. None of these values are a secret. How secure is it to assume that no other possible values ...
7
votes
2answers
163 views

Abstracting primitives and modes of operation

I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ...
6
votes
5answers
1k views

Is there a hash function with 2048bit output?

Is there a publicly available cryptographic hashing algorithm with 2048 bit output? The standard ones are "only" up to 512 bit (SHA-512, WHIRLPOOL). (2048 bits are 256 bytes, so it would be useful ...
6
votes
2answers
938 views

Could an HMAC be used as a hash?

MD5 is considered broken and SHA-1 is closely following, but HMACs built around either are still considered relatively secure. It makes me wonder if MD5 and SHA-1 HMACs can be used as secure hashes. ...
6
votes
4answers
621 views

Does MD5 generate 128 independent bits?

I heard that there are 128 stochastically independent bits in an MD5 output. Is that true? If so, are there any citations or proofs for that?
6
votes
2answers
4k views

Using a Hash as a secure PRNG

I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
6
votes
4answers
1k views

What good is a hash accompanying a program?

After studying at length about weaknesses in SHA2, length extension attacks, forged signatures, etc. I have to ask why groups like Gnu provide hashes on their program texts? As long as the public ...
6
votes
2answers
1k views

Can the XOR of two non-collision-resistant hashes be collision resistant?

Suppose I have two hash functions, of which neither (or only one) is collision resistant, and I want to create a new hash function by taking the bitwise exclusive or (XOR) of the results of those two ...
6
votes
3answers
3k views

Do I have to recompute all hashes if I change the work factor in bcrypt?

The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
6
votes
4answers
2k views

Constructing a block-cipher from a hash function

It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it ...
6
votes
3answers
1k views

Getting started [closed]

I'm looking for a good place to start in cryptography and places to go to get free books etc on the topic. I have been looking online but I always get stuck at some point or another. I need something ...
6
votes
2answers
141 views

Why do cryptographic hashing and symmetric encryption use different functions?

Something about encryption and hashing has always bothered me. Given a cryptographically secure hash function $H$, I can produce an arbitrarily long key from any seed $s$ by recursively applying $H$ ...
6
votes
1answer
884 views

Good enough deterministic PRNG based on hashes

Lets say I have a seed named iv which has a decent amount of entropy. Are there any glaring issues with the following? First 64 bytes are generated by SHA512(iv) Next 64 bytes are generated by ...
6
votes
4answers
2k views

How can I validate a hashed password if all I have is another hash?

The Scenario I have a client-side web application that bounces requests against a server-side API. For the sake of simplicity, every request must pass a username and password. This is similar to ...
6
votes
2answers
190 views

What is wrong in the following algorithm for computing a hash function using RSA?

I'm studying for a cryto exam and have run across this question which has stumped me. What is wrong in the following algorithm for computing a hash function? Take a message $M$, generate a random ...
6
votes
2answers
496 views

If attacker knows salt and hash, how is salt effective?

Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how ...
6
votes
3answers
436 views

Can passwords be stored securely so that a similarity comparison can be made?

On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I ...
6
votes
2answers
651 views

Why do I need to add the original salt to each hash iteration of a password?

I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash ...
6
votes
1answer
348 views

Any point in waiting for the SHA-3 standard?

The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter? That is, can we just assume it's going to be as specified by the submitters (...
6
votes
2answers
538 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...
6
votes
2answers
806 views

Are cryptographic hash functions perfect hash functions?

For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ...
6
votes
1answer
1k views

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
6
votes
1answer
395 views

Formal definition of “explicit” algorithm?

A long time ago, I read that the definition of "cryptographic hash function" is "collision-resistant one-way function". (A similar definition shows up in the FIPS standards for SHA-1 etc.) But this ...
6
votes
3answers
677 views

Is this a good entropy collector and whitening technique?

I'm just reviewing a program someone wrote to provide high quality random data using an entropy collector and a hash based whitening technique. I'll try summarize the process: Collect entropy from ...
6
votes
2answers
436 views

Is storing the hash of a key together with ciphertext encrypted with that key secure?

Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
6
votes
1answer
447 views

What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
6
votes
1answer
262 views

Can iterated hashing be used to mitigate collision and preimage weaknesses?

How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two? For example, can MD5 be fixed (in practice) by ...
6
votes
1answer
163 views

How can one detect if a hash function doesn't have a full image?

Suppose we have a hash function $H: \{0,1\}^* \mapsto \{0,1\}^n$, that doesn't get all the $n$ length bitstrings as a value for any input, but is otherwise secure. Can that fact be detected? For ...
6
votes
2answers
791 views

Computationaly hard detokenization algorithm for credit card numbers

I am designing a vault that tokenizes credit card numbers (a plaintext that consists of 16 decimal digits), with the following requirements: Given some plaintext, the vault returns an index. If ...
6
votes
1answer
427 views

How can uniformity of hash functions (e.g. SHA-256) be proved?

In reading about the Bitcoin protocol I noticed how much its proofs-of-work apparently depend on uniformity of the SHA-256 hash function. And so presumably do many other applications. How do ...
6
votes
1answer
2k views

A single password manager vs password generator/hash

I have been wondering about the options available for managing passwords. However, they all seem to fail if the master password is compromised (which isn't a big surprise). On one hand you have ...
6
votes
2answers
1k views

Hash decrypts key, key decrypts cipher… why?

I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
6
votes
1answer
571 views

Can hash functions improve a lousy PRNG?

If I have a poor PRNG, could a cryptographically secure hash function make a better output? Say the PRNG can produce as much numbers as you wish, reasonably random, but not good enough to be used in ...
6
votes
2answers
622 views

Meaning of “family” in “family of hash functions”

Many definitions related to universal hashing mention the term "a family of hash functions, say $H$". What does this 'family' mean exactly? A numerical example would be appreciated. Also, what does it ...
6
votes
2answers
3k views

Difference between “one-way function” and “cryptographic hash function”

What's the difference between a one-way function and a cryptographic hash function?