# Tag Info

2

I prefer using definitions that explicitly specify who does what. Weak collision resistance: After Bob creates some message x1, it is "computationally infeasible" for an attacker Mallory to compute some other message x2 such that h(x1) == h(x2). Strong collision resistance: It is "computationally infeasible" for an attacker Mallory to find any two messages ...

1

First, I must warn you that any definition that uses "feasible" will not be a rigorous one. The only way I know to rigorously define collision and preimage resistances is using function families, i.e. keyed hash functions. That said, if you believe the negations are equivalent, the definitions you are using are themselves equivalent (you correctly negated ...

0

I think your two negations are not the same, here is my reasoning: The existence of a $x \in D$ for which it is feasible to find a second pre-image (the second negation), does not guarantee that it is feasible to find that $x$. Therefore, the second negation does not immediately imply the first.

2

MD5 is a Merkle–Damgård hash, so it's vulnerable to the length extension attack. That means there's a simple way to find multicollisions using any algorithm that can find collisions for an arbitrary IV: Find some collision $\operatorname{MD5}(a) = \operatorname{MD5}(b)$ using the normal IV. Find another collision $\operatorname{MD5}'(c) = ... 2 Are variable-length crypto hash functions still susceptible to collisions? Yes. Even if you choose an output length equal to the input length, you expect some collisions from even an ideal PRF. E.g., if my test code works:$\operatorname{SHAKE256}(\text{'6'}, 8) = \operatorname{SHAKE256}(\text{'8'}, 8)\$. Is there any work done to show or prove ...

5

Is there any work done to show or prove collision resistance gained by increasing digest length? Actually, as CodesInChaos has mentioned, the variable length versions of Keccak ("SHAKE128" and "SHAKE256") are known not to have any collision resistance beyond their security level, independent of how long we make the output. So, what's the point? So, as ...

5

What you are describing is essentially the same things as a hash list. A hash list is a sequence of hashes over which another hash is calculated. Your scheme does the same thing after sorting. The sorting won't matter for the security of the scheme; it won't increase the chance of collisions. Hash lists are also used for a well known structure called a ...

2

Sending a hashed password adds no value. Consider this, what the client sends after the hash is what the server considers as a password. Additionally; you are leaking an implementation detail on the client. SSL/TLS already ensure channel security; and then using a slow password hashing algorithm has already been proven to work. Precomputing the hash does not ...

12

Short answer: don't. Use a password hash like PBKDF2, scrypt or bcrypt. Also, if at all possible, use a library that takes care of the low level stuff like password database for you. E.g. passlib might work if you use Python. I'm sorry if that sounds blunt, but that's how it is. To answer your actual questions: There is just only one thing which ...

Top 50 recent answers are included