A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (2)

3
votes
1answer
151 views

Is a using salt important when creating a hash data validator?

I am creating a service that will return an set of objects, which will be used by multiple systems. At the end of the process, one (or more) of the objects will be sent back to our system for ...
3
votes
1answer
45 views

What are fixed points and length extension attack in hash functions?

I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...
3
votes
2answers
66 views

Misuse-resistant authenticated encryption based on SHA-3/Blake2b and AES-CTR/ChaCha20

I am wondering if the following is a useful misuse-resistant authenticated encryption scheme: Parameters (shared by many users): Choose a hash function $H$, such as Blake2 or Keccak. SHA2 could ...
3
votes
2answers
184 views

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5. Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered ...
3
votes
2answers
210 views

Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
3
votes
2answers
100 views

How to find 64 collisions for a hash value?

The first block $M_0$ is one of 64 possible values, whereas the next six blocks $M_1...M_6$ are chosen randomly. The idea is to publish the SHA-1 hash of $M_0...M_6$, wait for the value of $M_0$ to be ...
3
votes
2answers
211 views

What is the use case for XOF functions (i.e. SHAKE128/256)?

FIPS 202 defines 2 functions: SHAKE128 SHAKE256 As extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
3
votes
1answer
123 views

Can the round function $F$ in a Feistel Network be practically any non-invertible function?

This question might seem silly, but how true is the fact that the round function $F$ does not have to be invertible? I am curious to know this, because non-invertible functions can be very lossy, ...
3
votes
2answers
333 views

Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
3
votes
1answer
484 views

Password hashing in /etc/shadow

Passwords hashed under Unix/Linux systems can use several hashing algorithms. ...
3
votes
3answers
255 views

Allowing the user to choose the hashing formula at the registration

I was thinking of a potential new way to increase someone's account security. The idea was allowing the user to choose one of the hash formulas available in the software (example: "MD5", "SHA512" and ...
3
votes
3answers
183 views

Hash Family Example

I am reading my lecture and I found this definition: Let be $F$ be a family of hash functions, that is, a parameterized set $$F=\{g_k:\{0,1\}^{*}\rightarrow\{0,1\}^{n}|k\in K\},$$ where $n\in ...
3
votes
2answers
1k views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
3
votes
1answer
128 views

Hashing a password with the password?

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
3
votes
2answers
595 views

How does using salt reduce rainbow table attack?

I could create a rainbow table for a particular salt value and still create a successful attack similar to one without salt value.
3
votes
1answer
541 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
3
votes
2answers
172 views

Is there an advantage to storing keys split between several hashes?

I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please ...
3
votes
1answer
2k views

“Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
3
votes
1answer
220 views

A set of key pairs and one hash to secure them

I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ...
3
votes
1answer
59 views

What are the time considerations with regard to security against birthday attack?

When designing security for a physical safe, one of the critical specifications is how long will the safe resist attack, this tells you how quickly you must detect and respond to an attack on the ...
3
votes
1answer
107 views

Differential Cryptanalysis for Hash functions

How is differential cryptanalysis used to attack hash functions? I've been struggling through a couple academic papers and thesis's on the subject but they all sound like greek to me. Does anyone know ...
3
votes
1answer
143 views

Is finding collisions in a part-hash not often enough a bad problem?

My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at ...
3
votes
2answers
171 views

Is there any relation between two strings with the same MD5 hash?

Is there any relation between two strings with the same MD5 hash? For example these two strings: ...
3
votes
1answer
128 views

Encrypt a message with hash function, shared symmetric key, but no cipher

I am very new to Crypto and need some clarification or input. The question is: Suppose that Alice wants to encrypt a message for Bob, where the message consists of three plaintext blocks, $P_0$, ...
3
votes
2answers
125 views

How does DSA provide non-repudiation in proving a document was properly displayed (not altered or displayed incorrectly)?

I am building an iOS app that allows the user to sign a document served to them by a web server. So that page of the app simply has a document in the top pane, and at the bottom pane, a place to sign ...
3
votes
1answer
49 views

Favor hash size or field size when systems are disparate?

I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library. C++ has some features where classes that represent the crypto objects can be combined ...
3
votes
4answers
433 views

Password length versus hash length?

If a system hashes passwords with a 256-bit long hash, are passwords (which are not necessarily alphanumeric, can be any value per byte (0-255)) longer than 32 bytes useless under the context in which ...
3
votes
2answers
2k views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
3
votes
1answer
215 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
3
votes
1answer
440 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
3answers
760 views

What are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?

In a commitment scheme, are there any differences on using a symmetric cipher versus using a hash? If at the "opening", I have to reveal $r$ (a random number concatenated with the messaged at the ...
3
votes
1answer
101 views

Hashing a message with a length that isn't a multiple of 8 bits

NIST FIPS 180-4. “5.1. Padding the Message.” Suppose that the length of the message, $M$, is $l$ bits. Is there any library that can receive a message of length (in bits) which is not a multiple ...
3
votes
2answers
512 views

Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm?

I have constructed a stream cipher from a secure hash algorithm and a HMAC. Here is a brief description of the algorithm: Let: (Actually Objective-C styled pseudo code) ...
3
votes
3answers
340 views

Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
3
votes
1answer
1k views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
3
votes
1answer
258 views

How to use salt if I am sending hashed password?

If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
3
votes
1answer
193 views

DIfferent inner and outer hash functions for NIST Recommended HMAC?

The NIST recommended HMAC uses $$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$ Is it ...
3
votes
1answer
259 views

Is there a known vulnerability when using identical key and salt with PBKDF2?

For optimum security, a random salt should be chosen for PBKDF2. I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...
3
votes
1answer
395 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
3
votes
1answer
78 views

Is there any function that does not suffers birthday problem?

I am eager to know that if there is any function that does not suffer birthday problem and how to prove it formally that the function is not suffering the birthday problem.
3
votes
1answer
69 views

Reversing a hash of known hashing algorithm

I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this, So there is this hash function which operates on a message which is in the form of a byte array ...
3
votes
2answers
91 views

Long passwords and Bcrypt

I need to store passwords for a web application, and was looking at Bcrypt for a possible solution. After some research, it appears only the first 72 bytes influence the final hash output. While it is ...
3
votes
1answer
125 views

What is tiger192,4 in PHP?

PHP supports hashing of the following Tiger algorithms: tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 Wikipedia's entry on Tiger says there's Tiger and Tiger2 and provides ...
3
votes
1answer
186 views

Hash functions to generate one time pad

Newbie question... may be... Stream cypher, will XOR message bits with one time pad bits Suppose I have a pseudo random number generator, like a Mersenne twister or sort of. I could use the ...
3
votes
1answer
159 views

Save the last cycle in GCM GHASH calculation

I need to implement GCM GHASH in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size is fixed and AAD is 0. A little example: ...
3
votes
2answers
156 views

How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?

Suppose I have two arrays : A = a single byte, being zero. B = two bytes, both being zero. B = A||0 (i.e. B starts with A, and differs only by appending a zero byte) BLAKE2(A) != BLAKE2(B) Yet, ...
3
votes
2answers
128 views

Memory-expensive hash from an array of hashes?

Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking? What I have in mind myself is this: We have an input $X$, we ...
3
votes
1answer
355 views

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity?

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity? My reasoning is that the attacker doesn't know all the plaintext, so by having a hash, the ...
3
votes
1answer
126 views

Is there a practical upper limit for password rehashing?

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security? Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, ...
3
votes
1answer
303 views

Does adding a salt to the message before HMAC processing add any security?

An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...