Hot answers tagged

11

The disadvantage of this approach is that block ciphers are not necessarily designed with this goal in mind. Specifically, AES has related-key problems, and DES completely breaks in Davies-Meyer. In general, block ciphers are not necessarily ideal ciphers and should be used as intended which is as pseudorandom permutations. In contrast, SHA256 and the like ...


7

I'd say the key thing that you need to spell out to answer this question is this: What information does the attacker have? This ties to one of the basic concepts of cryptography, called Kerckhoffs's principle: "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." (I recommend you read that page and ...


5

What are the advantages/disadvantages of this approach instead of using traditional hash functions, such as MD5 and SHA-1? Those are not precisely alternative approaches. MD5 and SHA-1 use Davies-Meyer construction with certain block ciphers that do not see much use on their own (SHACAL has seen some). So in a way you are already doing that if you use MD5 ...


4

I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer. That one is largely correct, although more bits doesn't have to mean "less-efficient" as for example Skein-512 ...


4

As I have a new hash every 3 second, it's easy for everyone to collect a big numbers of hash. And as the difference between every UUID is always 3000 ms, maybe this could make it easier for the hacker to crack the key. You might be reassured to read up on the security requirements that MACs are designed for. Chapter 9 of the Handbook of Applied ...


4

Surprisingly enough, it would appear that generating a simultaneous collision wouldn't be that much more expensive than generating a single collision for SHA-1. The basic idea is to form a $2^{64}$ wide multicollision on SHA-1; that is, $2^{64}$ distinct messages that all SHA-1 hash to the same value. We can do this by using Joux's idea of forming finding ...


3

Can someone explain me how the t actually affects the outcome of the procedure (which, as far as I understand, just calculates the eight 64-bit words xor with "a5a5a5a5a5a5a5a5")? That's not right. Both hex 5 and A are encoded setting two bits out of 4; a5 translates to 1010 0101 in bits. I.e. half the bits are flipped. This kind of XOR value is often ...


3

TL;DR: Using words instead of strings / images may be a good solution for short, easy-to-verify codes and using locality / time dependent verification codes strengthens short hashes as would using password-hashes. Additionally to the improvements to comparability of the hash proposed by A. Toumantsev, I will propose three extra measures which I believe may ...


3

A password has low entropy. Assuming that you hash in order to reduce the winning probabilities of someone trying to guess it, you do not do a lot better. The adversary will simple try all the possible combinations, evaluate the hash and check equivalence as long as he has acquired the server with the saved hashed passwords


3

Let $h=E_{x_i}(z_{i-1})$ in your suggestion. Let $z'=E^{-1}_{x'}(h)$. This gives a collision between between $(x_i,z_{i-1})$ and $(x',z').$ The XOR makes this attack difficult.


3

It is easy to design a hash function which output always has the pattern(s) in the question, but which will be computationally indistinguishable from a random function producing such pattern(s) to an attacker not holding a certain internal key. An example would be HMAC-SHA-512 with a secret key, followed by reformatting and truncation to match the pattern ...


3

HMAC-SHA256 is extremely safe. In the question's use, the key is large (48 characters, likely >160 bits of entropy). From a theoretical standpoint, everything checks. HMAC is demonstrably resistant (to 128-bit level) even if an adversary can obtain the MAC of chosen messages, under weak hypothesis for SHA-256 (see M. Bellare: New Proofs for NMAC and HMAC: ...


3

There is work underway to specify KMAC. It's basically just SHA-3, but with a length specification for the key and a special value to indicate that this is KMAC instead of hashing. These constructions are required to make sure that there are no unfortunate collisions with previously hashed data or - more importantly - key / message pairs where $H(K_1,M_1) = ...


2

I think that it was to make sure that the leading zeroes in the data to hash are taken into account during the hash. Without the '1' prefix value, those leading zeroes would make the fingerprint stay to zero. Without the '1' prefix, the following 2 list of bytes would have the same fingerprint: [42, 5, 3] [0, 0, 0, 0, 0, 0, 0, 0, 0, 42, 5, 3]


2

r determines the sequential read size. This should only be changed if you have custom hardware that has a memory subsystem with different characteristics. It takes time to pull data from main memory, and the sequential read size allows the memory latency and CPU processing to be well-balanced on your system. Treat it like a constant unless you know what you'...


2

It is quite practical to deliberately generate two different files with the same MD5 hash; if you were handed these files by someone else, it is possible that they did this. However, MD5 will collide only if someone deliberately crafts the files to do so; if you modified the files somehow, then this is unlikely to happen. Instead, it would be a strong ...


2

First use the TID as input for a KDF to generate one or more tag specific keys, using a static, symmetric master key stored in the initialization software and gadget. Use one of these keys to obtain access. Use another for verification of the tag. During initialization derive and set the access key (s). Then create a HMAC over a static value (or multiple ...


2

Can you please explain me what this notation means? Of course, $f:A\times B\times C\rightarrow D$ is fancy mathematican's language for saying: "a function f, that takes an element from A, B and C (in this order) and maps this to an element of D" (arbitrarily extend this explanation to as many arguments as you wish). In this particular instance, the ...


1

That is the point of ROM. You assume 'somehow' the existence of a truly random function with no collisions. You do not care how this is constructed and designed because there is no real truly random hash function. But you assume it exists in an ideal world. Of course this has implications in real world because such a function does not exist. But ROM ...


1

I'm not commenting on the security side of the solution, there are real experts here who can help with this (or turn your idea right down ;) ). However, assuming your solution (with SHA256) is acceptable and secure, your main problem seems to be that "carefully comparing all the digits of a SHA-256 hash .. takes a while". Indeed, comparing a string of 64 ...


1

It's a good point, because in the first instance: dog Is less secure than their SHA-512 hash used like a password: 3bbed9c106ceaea9e1d1f851b493a52582ae6f6deab8170da43da346a8710622b21d6c2ca14c6336bdc770f161673bef5edad6e65d86b05be62817bc9088d924 Using brute-force in this case is madness, so the best option to crack it is a dictionary attack... ...


1

Preimage resistance is usually defined not for all the inputs, but for all the outputs, since what you are trying to model is the inability to, given any output $y$, obtain an input $x$ such that $H(x) = y$. I'm not going to solve the problem for you since you may be able to do it by yourself. Just try to think of the patterns in the output and if this can ...


1

The main question about this topic is: Guarding against cryptanalytic breakthroughs: combining multiple hash functions. There you will find some better combiners for multiple hash functions. I would generally recommend against the extra complexity - a single good hash ought to be enough. Now, regarding your way of combining them: Does this make sense? ...


1

The basic problem seems to be that of canonicalization. If you can't reorder the set, then you will have to choose a commutative, associative, operator to concatenate the values; $a \otimes b = b \otimes a$ and also $a \otimes (b \otimes c) = (a \otimes b) \otimes c$ An immediate candidate for this would be to interpret the elements, $m_i$ as integers and ...


1

As pointed out by @kodlu, given an input sequence of 512 bits ($2^{512}$ possibilities), and given a hash function which spreads out the resulting hash approximately evenly, you would wind up with approximately $\frac{2^{512}}{2^{256}} = 2^{256}$ input sequences in your table which store the result of your exhaustive mapping for a given 256 bits hash (...


1

If you're tossing $n=2^{512}$ balls into $m=2^{256}$ bins, as a model of a good hash function, so $n=m^2$, the average load will be $n/m=m$ so the typical output will have $2^{256}-$fold collisions. See paper here, last case of theorem 1, whereby the maximum load won't be too far away from average load in a multiplicative sense, in your case. What about ...


1

What you're looking for is called a Merkle tree. BLAKE2b, a modern hash and an evolution of one of the SHA-3 finalists (BLAKE), supports tree hashing natively. Edit: This may or may not actually be what you're looking for. Initially hashing the tree will take more work ($\mathcal{O}(n\log(n))$ operations) than just hashing the set of hashes, but subsequent ...


1

Generating collisions for a 32-bit hash is trivial; thanks to birthday paradox, the expected effort is only about 217 hash evaluations. If you don't believe me, try running this Perl code: use strict; use warnings; use Digest::SHA 'sha256'; my $message = "a"; my %preimages; while (1) { my $hash = unpack("H8", sha256($message)); print "$hash: $...



Only top voted, non community-wiki answers of a minimum length are eligible