Tag Info

5

Baring an improbable tremendous theoretical breakthrough, any odd of any kind of collision among SHA-512 hashes, for any cause except identical input or computing failure, is negligible in practice; we'll thus handle this from a theoretical standpoint. Let $s=512$ be the hash width; $k=1000$ the number of hash iterations; and $q>0$ the number of stored ...

4

The question errs precisely at the point when it writes: $$\text{and so }H(x')=y.$$ Problem is: that holds for $x'$ matching some garbage $z'$, including $z'=z$, and perhaps other garbage $z'$, but we do not know which garbage (or $z$ unless we know $x$), and I see no reason that it holds for $x'$ obtained from any garbage $z'$ except for trivial $H$; and ...

3

I'm not sure if you want to model existing hash functions with a general model, or invent a new one. The usual general definition of hash function is a function which takes a variable length input bit string and produces a fixed length output bit string: $h : \mathbb{Z}_2^* → \mathbb{Z}_2^n$ ($n$ being the output length). All real-live hash functions I ...

3

The threat model of password storage is that of server compromision, where the attacker gain access to the database and server code. The attacker can then run the code to test password candidates, possibly making modifications, porting to faster platform, etc. The attacker will not bother computing the fake hash and fake salt. So this scheme is twice as ...

3

There are a bunch of problems with this protocol. First of all, the way you generate your RC4 key (concatenate a secret key with a public nonce) is known to be weak. The one thing that saves you is that you only do it 256 times before generating a fresh secret key; however it is known that if you were to do it, say, 2000 times with a secret key, you would ...

3

A possible deficiency is that if the use made of any $K_j$ allows it to leak, all later security is lost. That makes $K_j$ plain unsuitable in some uses, e.g. directly as keystream for short messages. The $K_j$ must be wide enough that it is extremely unlikely that a cycle is ever reached in deriving them. For plausible parameters that translates to ...

2

The resume of that other answer could be: When you have a password hashed, it's hard (very hard) to find out what was the original password: you have to try all combinations, until you find the hash. That's brute-force. Someone can speed up a bit this process, by pre-computing many passwords: he'll store all those passwords / hashes, and will try to find ...

2

If you assume the hash function as block box with no known preimage attack, then you can do the following to get a "more secure" hash: You have a message $m$ and a hash function $h(\cdot)$, and you want to extend the hash length by factor $k$. Assuming the hash function as block box, you don't change anything if you add a fixed prefix or suffix to the ...

2

a Using a moderate number of iterations is a standard approach in password based key derivation (see for example, http://en.wikipedia.org/wiki/PBKDF2, RCF 2898 http://tools.ietf.org/html/rfc2898). It can also be used in the sceanrio described. In this case if an attacker gets access to your password database it should slow down the attacker by a factor ...

1

Yes, the internal word size of a hash algorithm has some significance, pretty much for the reasons given in the question. Algorithms with 64-bit word size have a (typically sizable) performance edge on 64-bit machines (more precisely: for large messages, and comparable implementations, the ratio of the number of bytes hashed in a given time over that for a ...

1

Simply put, you need to first understand why that code is bad. You also need to know what preimage resistance is. The comments tell you the algorithm, you don't even need to read the code. // Pad the String with spaces so that it is a multiple of 4 characters // XOR each consecutive 4 byte block This is not cryptographically secure, or even secure from a ...

1

I would have made this a comment, but I don't have enough reputation points. I think this is a good question. I don't see how a timing attack could be done in any practical manner. I ran a quick test on two 256 bit/32byte keys I generated. I did a simple "for" over them, comparing each character. Here are the results of my testing. LAST BYTE ...

1

If the resulting hashes were the same, a non length-constant check would compare every byte of the resultant digest. This would take the most time to compare. Lets say it takes 90.00ms to run the KDF, and 0.90ms to do a full length compare (not real numbers but good enough for the example) If the password was "hello" instead of "Hello", it is probable that ...

1

While trying to reverse the 'hash' that was mentioned in one of the comments, I discovered the real problem. In short, the problem of finding the valid garbage is bigger than the problem of finding the input. That is, the procedure is correct, but it makes the problem more difficult than the original. The detailed explanation Suppose you are trying to ...

1

Your basic problem is, that your circuit would require infinite many output bits (to be precise, the garbage is infinite). The input for each gate is 3 bit, and you end up with 3 bit. You can duplicate bits in a circuit (by using it as input to multiple gates), but you can NEVER throw away bits or reduce the circuits information. This means, that the output ...

1

Security properties of hash functions are generally concerned with collision resistance, but preimage resistance is also important. For most common hash functions with an $n$-bit digest size, a successful preimage attack has generic $2^n$ maximum complexity, and a successful collision attack has generic $2^{n/2}$ maximum complexity. Most common hash ...

1

If the salt value is not secret and may be generated at random and stored with the password hash, a large salt value prevents precomputation attacks, including rainbow tables, by ensuring that each user's password is hashed uniquely. This means that two users with the same password will have different password hashes (assuming different salts are used). In ...

1

What you want is a PRF. For example, the one described in the TLS 1.2 RFC, which is defined as follows: P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + HMAC_hash(secret, A(2) + seed) + HMAC_hash(secret, A(3) + seed) + ... where + indicates concatenation. A() is defined as: A(0) = seed ...

Only top voted, non community-wiki answers of a minimum length are eligible