A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (2)

4
votes
2answers
3k views

what kind of hash function can provide a short hash and be collision resistant?

When you try to connect via SSH, you see a signature which is short but I heard it is even stronger than sha256. It is perhaps stronger because it uses more rounds. Is there a hash function or a ...
4
votes
2answers
628 views

How did LinkedIn “salt” all their passwords?

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
4
votes
1answer
242 views

Question about hash collisions

If we have a hash function $h(x)$ and then a hash function $H(X) = h(h(X_0) || h(X_1))$ where $X_0$ is the first half of $X$, $X_1$ is the second half of $X$ and $||$ is concatenation. Then assuming ...
4
votes
2answers
64 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
4
votes
2answers
193 views

Are variable-length crypto hash functions still susceptible to collisions?

I just recently learned that the SHA-3 finalist Keccak allows for variable length output. As the only answer to this question states, "[it] need to have an output length at least equal to the input ...
4
votes
3answers
206 views

Do I need to use AE/AEAD in my particular scenario? Or is it redundant?

This is my scenario: A small structured text message (1-2kB) is to be sent over an insecure channel. Everything except for the header portion (which contains a title, timestamp, category and tags) ...
4
votes
1answer
210 views

How can I tell how many bits of security a secure hash function has?

How can I tell how many bits of security a secure hash function has? For example, how would I calculate or tell how many bits of security a secure hash function with 160 bits output would have? ...
4
votes
3answers
279 views

Can insecure algorithms be combined to form a secure algorithm?

This is hypothetical as I can't think of any reason to do this, but out of curiosity... Could I, for example, take the MD5 digest of a message and concatenate it with the SHA-1 digest (not quite ...
4
votes
1answer
409 views

Why is feed-forward mechanism used in hash functions?

The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
4
votes
3answers
964 views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
4
votes
2answers
337 views

Brute-force attack given small search-space and hash prefix

Suppose we have a value $secret which is a random 56-bit (7-byte) string. Suppose an adversary wishes to discover $secret. The ...
4
votes
1answer
252 views

What is the “compression function” in Merkle-Damgård?

Is the "compression function" in Merkle-Damgård just a collision-resistant, one-way hash function but one that operates only on fixed size inputs? If so, is MD just a way to extend it to work on ...
4
votes
2answers
307 views

Inserting a backdoor into a cryptographic hash function

I'm curious as to how a backdoor can be built into a hash function. What might it take the form of? What's probability of getting one that can be backdoored in a way that can actually undermine its ...
4
votes
2answers
381 views

Signing Files vs. Signing File Hashes

What are the security pitfalls that may occur by signing a list of file hashes, versus signing individual files? In short, the security trade-offs between: ...
4
votes
2answers
293 views

Share encrypted files without giving master key

Imagine I have four files I want to encrypt. I have master key, and from that master key I derive four keys, one for each file: ...
4
votes
2answers
950 views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
4
votes
1answer
176 views

Understanding hash entropy

I have been told that one advantage of using a hash function is that it spreads entropy over all input bits. But it also seems to be true that a bad hash algorithm can make things less random. But how ...
4
votes
2answers
385 views

Hash function based on block cipher (and proof of security in the PRP model)

Do there exist proofs of security for primitives like hash functions (based on a block cipher) in the PRP model. I often see proofs in the random oracle model (for hash function based on compression ...
4
votes
1answer
1k views

Hashing passwords with a salt - why use different salt for everyone?

Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
4
votes
1answer
735 views

Exhausting the entropy of a hash function

In the case of password storage, consider the following: I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
4
votes
4answers
360 views

How to prove membership of a list without disclosing the list members?

I'm designing a messaging system where the sender A sends a message m with a signature s to n Receivers. A Receiver Ri should then be able to prove to a Verifier V that he is one of the receivers of ...
4
votes
3answers
3k views

How can I create a fixed length output in my hash function?

I've been recently looking into the creation (and theory) of hash functions, however I just can't figure out how to turn a message into something of a fixed length. At the moment, my theory of a hash ...
4
votes
1answer
231 views

Is the last step of an iterated cryptographic hash still as resistant to preimage attacks as the original hash?

Considering a cryptographic hash, such as MD5 or SHA2, denoted by the function $H(m)$ where $m$ is an arbitrary binary string, there is a lot of material available that deals with potential weakness ...
4
votes
1answer
104 views

Could we share a secret key using the Birthday problem?

I stumbled upon this code on-line, it seems obvious to me that generating all 2^40 keys in trivial time can always be achieved as can hashing each and everyone of them, using the SHARED Salt that ...
4
votes
2answers
121 views

Is there such a thing as a hash function with a fixed size input?

That seems like it would be a useful primitive. Using it in place of a block cipher in the Merkle–Damgård construction would give a variable-length hash, maybe without the tricky business with related ...
4
votes
2answers
175 views

Public key crypto instead of hashing passwords in a database

Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password. Now I generates a public/private keypair. Then I send the public ...
4
votes
2answers
224 views

Signature and hash function properties

I understand the need for the hash function to be collision resistant and second pre-image resistant. For what reason, exactly, does a hash function need to be pre-image resistant? If this property ...
4
votes
1answer
175 views

Is hashing a list of hashes safe?

I have an arbitrary long list of hashes (e.g. git tree hashes), and I'm wondering by how much I am increasing the risk of hash collisions by condensing them into a single hash, like so: ...
4
votes
2answers
130 views

Does knowing multiple hash of the same content make it more likely to generate original plain text?

Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text ...
4
votes
1answer
177 views

Is there a reason that the N value in scrypt is limited to powers of two?

I have been looking at the scrypt hashing algorithm and am confused as to why the N value, which determines the overall cost, is limited to powers of two. There are ...
4
votes
2answers
560 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
4
votes
2answers
2k views

Difference between salted hash and keyed hashing?

A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash ...
4
votes
1answer
83 views

“proof of access” schemes

What is the state of the art way when implementing a scheme challenging a party to prove they have access to certain data? What I'm looking for something along the lines of Give them ...
4
votes
1answer
794 views

Recommended way of adding a pepper/secret key to password before hashing?

There have been several questions regarding password hashing here and on Security.SE. A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing ...
4
votes
1answer
262 views

Why are there $ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
4
votes
3answers
1k views

Hash function in PBKDF2

From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
4
votes
1answer
557 views

How is BCrypt secure when it uses a static dataset for blowfish hashing?

I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and ...
4
votes
1answer
3k views

How does PBKDF1 work?

I need some basic guideline on Password Based Key Derivation Function. PBKDF1 generates a key from password and salt using Hashing algorithm (like SHA1, SHA256, MD5). What is the step behind this?
4
votes
1answer
819 views

Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? I am trying to find them in the original Keccak documentation but can't find them. Is it some special mode of Keccak referenced in the documentation? ...
4
votes
1answer
167 views

Compression function to guarantee randomness of one time pads?

First of all, I would like to note that I am not building my own crypto. I am simply curious and would like to learn. What I am wondering is this: if we are worried about randomness of something ...
4
votes
1answer
755 views

How can I generate a one-time password?

Through my reading about the generation of one-time password (OTP) I found that there are many algorithms that generate OTP and they are either based on time such as TOTP or based on mathematical ...
4
votes
1answer
776 views

Can one group the SHA-256 outputs depending on partial inputs?

Is it possible to predict a hash key based on half key? Let's have some example: I have 100000000 hash results, and they are generated by either ...
4
votes
1answer
77 views

Can a list of hashes with property $X_{n+1} = \operatorname{SHA-256}(X_n)$ loop?

This is the situation: I have a list of hashes where each hash is always the SHA-256 of the one above it. If I keep going down the list it must at some point loop since there can only be $16^{64}$ ...
4
votes
1answer
107 views

Effect of message length on collision attacks

I know that message collisions are supposed to be hard to calculate for a good cryptographic hash. Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash. ...
4
votes
1answer
196 views

How have MD5 constants been determined?

For instance, the per round shift amounts, ...
4
votes
1answer
95 views

Are shorter password hashes safe?

How much can I shorten a password hash before it begins to impact security? Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 ...
4
votes
2answers
98 views

A periodic PRNG based on hash function?

I need a PRNG which provides 128 bytes numbers. Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way: The output is PRNG($K, s$) = ...
4
votes
2answers
102 views

Brute-force attack given multiple hash prefixes

(Context: I'm auditing some code which I suspect to be insecure, but I'd like to be able to quantify this.) Suppose you have a 56-bit secret key ($secret), and ...
4
votes
1answer
240 views

How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?

Given a cryptographic hash function $h$, for example SHA256, how hard is it to find plaintexts $a,b,c$ such that $$h(a)\oplus h(b)=h(c) \text?$$
4
votes
1answer
189 views

Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$

So far as I can find, every method better at producing hash collisions in cryptographic hashes than generic collision search involves finding some metric for the distance between two messages' hashes ...