# Tag Info

3

With a hash function that is vulnerable to length extension attacks, like SHA-256, you can turn any random collision into a collision with that random string concatenated with some (partially) chosen data. In any use case where random initial data does not matter, you could use it to generate two documents which have the same hash value and thus the same ...

6

With respect to collisions, hashing twice can not increase security, because if $x$ and $x'\ne x$ collide for $H$, that is $H(x)=H(x')$, then $H(H(x))=H(H(x'))$. Otherwise said, any collision for $H$ is a collision for the double hash $H\circ H$. It is therefore trivial to exhibit collisions for $\operatorname{MD5}\circ\operatorname{MD5}$. Hence the answer ...

3

One reason is convenience: if the IV was variable, it would have to be transmitted to a party verifying the hash, and we'd have to deal with its integrity. Another reason is that it avoids an attack in a Merkle–Damgård variant with padding reduced to appending a single 1 bit and as many zeros as necessary to end the block. With such scheme and common ...

2

Proof by contradiction is easy in this case. Assume the construction is not collision resistant. Then there's an adversary who can efficiently find a pair $H(x) = H(x')$. However, that also gives them $H_1(x) = H_1(x')$ and $H_2(x) = H_2(x')$, so neither hash function is collision resistant, which contradicts the assumption.

0

I think I found the answer to my own question, and please correct me if I'm wrong. Just for example, let $H_1$ be the collision resistant hash function and $H_2$ the not collision resistant one. This means that for some certain input $x' \neq x$, $H_2(x')=H_2(x)$. So $H(x) = H_1(x)||H_2(x)=h_1||h_2$ and $H(x') = H_1(x')||H_2(x')=h_1'||h_2$, which means that ...

2

MD5 has a collision probability of $1 / 2^{64}$ under the Birthday Paradox. Does this apply to any input given to MD5? As explained in the other answer, $2^{64}$ is the birthday bound of messages until probable collision, not a collision probability. For two random messages you'd expect a $1/2^{128}$ probability of a collision with a 128-bit hash. ...

5

The expected number of collisions (assuming that the hash function can be modeled as a random function) is precisely $2^{-n}\binom{m}{2}$; that is, the expected number of pairs of values $x \ne y$ with $H(x) = H(y)$ (and so, to answer Ricky's question, $H(x) = H(y) = H(z)$ would count as three collisions). The reasoning is the obvious one; there are ...

Top 50 recent answers are included