# Tag Info

2

Can we exhibit collisions, or second-preimages (with implies the former), for the ChaCha core? No, likely not. The Salsa20 and ChaCha cores both consist of a large number of "quarter-rounds" each of which is invertible and bijective. The only reason neither core is a bijection (and thus can have collisions) is the final addition of the input elements ...

1

The easiest, zero thought, way to get an answer to this question is to ask the computer. Using Dylan's cryptol implementation it is straight-forward to ask a question: m1 != m2 ==> ChaChaCore m1 != ChaChaCore m2 That is, if inputs m1 and m2 are not equal then the ChaCha core function will not be equal either. Cryptol doesn't (well, didn't) have an ...

2

The relevant part of Neven et al is this: What this means for practice is that one should not instantiate the hash function with a Merkle-Damgård iteration of an $n$-bit compression function. Instead, one should probably simply truncate the output of a $2n$-bit hash function to $n$ bits. (Such a method would in our situation be reminiscent of Lucks’ ...

5

NMAC is really just an "education tool" on the way to HMAC and I don't think anyone intended it to be used. The two keys are needed since the first and second hashes have different purposes. The first hash on the message is just needed to get collision resistance, whereas the second hash is supposed to provide a pseudorandom function type property. As such, ...

1

What is the run-time on finding collisions with MACs... Well, the definition of a MAC is of the form "if you don't know the key, then it is infeasible to ...". This definition does not assert anything if you do know the key (or are able to select it); hence it does not provide any nontrivial lower bound. In particular, with common MACs (e.g. CMAC, ...

0

MD has probability of collision 1 / 2^64 under birthday paradox but does this apply to any input given to MD5 ? Not quite. In the general case, the probability of a collision depends on the number of messages. The $2^{64}$ comes into play because we need $\approx 2^{64}$ messages for a $50$% probability that any two of those messages collide under MD5. ...

3

I had to do the exact same thing for unique product identifier codes. In my case they needed to be random looking, not cryptographically secure, so I had more room to work with. I still went with a cryptographic method since that is what I was familiar with. In your case, you are looking for just under $2^{36}$ values, for which all values are unique, and ...

Top 50 recent answers are included