# Tag Info

21

Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial state produces a different output. This implies that a combined hash will never contain duplicate bytes. Without this property a hash would forget about the ...

10

Because it is not secure enough. Hash functions rely a lot on diffusion (a single bit change must change half of the other bits) and confusion (the value of a bit should depend on the value of other bits). This is also known as the avalanche effect. Because it lacks a permutation, my first intuition: it lacks diffusion and has weakness to differential ...

4

I really like this question, and have two things to say. First note that CBC-MAC is no good since given the key it's easy to find a collision. Let $t$ be a tag for a message $m=m_1,m_2$ of length $\ell$ bits. Then, in CBC-MAC the input to AES first is $\ell$ and then the output is XORed with $m_1$ and input to AES, and so on. Let $t_1$ be the intermediate ...

3

Can we exhibit collisions, or second-preimages (with implies the former), for the ChaCha core? No, likely not. The Salsa20 and ChaCha cores both consist of a large number of "quarter-rounds" each of which is invertible and bijective. The only reason neither core is a bijection (and thus can have collisions) is the final addition of the input elements ...

3

The right terminology is second preimage resistance and preimage resistance. Edited to reflect comment by otus. Preimage attack takes $O(2^{n})$ hash function calls on average. Second preimage attack takes just one extra call so the complexity is essentially the same as that of the preimage attack. Given $x$ you want $x'\neq x$ such that $H(x)=H(x').$ So ...

3

The short answer is that for any secure hash it is impossible to generate collisions or second preimages, regardless of message length. If you look at theoretical attacks, however, message length can be a factor. When looking for another message that hashes to the same value as a specific message you are talking about second preimage resistance (or target ...

3

No, it is easy to show that (assuming that there are preimage-resistant functions at all) there are functions that the preimage-resistant, but not second-preimage resistant. If we assume that SHA512 is preimage resistant, one such function is: $$H(x) = SHA512(Trunc(x))$$ where $Trunc(x)$ just returns $x$ with the last byte removed. $H$ is not second-...

1

SHA-256 is¹ a cryptographic hash function. As such, it has preimage resistance: given a hash value, there is no way to find a string with that hash, except by trying all strings until you find one that works. Therefore you'll have to try all possible inputs, i.e. all strings that contain the known substring. (You can of course be smart about it: try the most ...

1

As I understand it, preimage resistance means that it is hard for an adversary to find two messages that produce the same digest Nope: collision resistance means that it is hard for an adversary to find two (distinct) messages that produce the same digest. Preimage resistance means that, given a hash output, it is hard for an adversary to find a message ...

1

Yes. ​ I believe this is the standard conversion. (That link is to the paper "Universal One-Way Hash Functions via Inaccessible Entropy".)

1

The easiest, zero thought, way to get an answer to this question is to ask the computer. Using Dylan's cryptol implementation it is straight-forward to ask a question: m1 != m2 ==> ChaChaCore m1 != ChaChaCore m2 That is, if inputs m1 and m2 are not equal then the ChaCha core function will not be equal either. Cryptol doesn't (well, didn't) have an ...

Only top voted, non community-wiki answers of a minimum length are eligible