Tag Info

Hot answers tagged

12

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles. Getting to the ...


7

For an adversary not knowing the definition of SHA-512 (or just not knowing the 512-bit initialization constant of SHA-512, defined as the first sixty-four bits of the fractional parts of the square roots of the first eight prime numbers), the sequence obtained by $$\begin{align*} H_0&=\text{SHA-512}(Seed){\small\text{ where }}Seed{\small\text{ is the ...


7

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? Yes. That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed. How much HMAC-SHA256 is slower than HMAC-SHA1? Those ...


6

There are many well known and studied ways of constructing a hash function from a block cipher. A thorough (but reasonably readable for a beginner) treatment of many of the classic approaches, and the security properties of the various constructions, can be found in Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV, which is ...


5

I don't know of any practical attacks on these schemes that would break collision-resistance or pre-image resistance, but the existence of related-key attacks on AES is still worrisome. The Miyaguchi-Preneel hash construction is better in this sense, because the attacker doesn't directly control anything that goes into the key input. Miyaguchi-Preneel is ...


5

Yes, we can build a hash function from a block cipher, and that's common, although with block ciphers designed for that purpose, when in the following I focus on AES, mentioned in the (different) question that motivated the present answer [which got moved here because said question was found to be a duplicate]. One classic method to obtain a hash function ...


4

First of all I do not know your implementation, but it seems that you have some basic misunderstandings. Signature: ECDSA(sha256(Data) ) ECDSA is typically implemented in a way that you do not explicitly hash the data prior to passing it to the signing algorithm (but as this might be your own implementation and signing may still work correctly). ...


4

Theoretically, there are several ways to turn a hash function into an encryption system. However, the Devil is in the details. A cryptographic hash function is a function which is resistant to preimages, second preimages, and collisions. As far as I know, it has not been proven that these conditions are sufficient to build a stream cipher. In fact, what we ...


4

The operation: X[16] & (N-1) is really, mathematically speaking: $$ X[16] \mathrm{\ mod\ } N $$ With a generic $N$, this operation must be done with an actual division, which is expensive; some CPU types don't provide it, and for CPU which do provide it (e.g. x86), it is quite slow (for instance, for 32-bit operands on an Intel Core2, division latency ...


3

The definition of "random" is something not very clear that deserves some more explanation, like what you expect from the output number sequence. If you want an uniformed distributed sequence you will get it. If you want an unpredictable sequence you won't. If you want a "sequence undistinguishable from random" you won't get it either.


3

Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified in transit/on storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes ...


3

That is an absolutely terrible idea, here is why. His algorithm works as follows: Hash the input data Take the length of data (presumably in bytes) TRUNCATE the hash so that the length value in bytes plus the truncated hash is the output length of a standard MD5 hash (128 bits) Here is an example of a 1MB data file being hashed MD5(data) = ...


3

While collision resistance can be defined for normal hash functions like SHA1, for target collision resistance you need a so called keyed hash function, that is a hash function that additionally to a message $m$ also takes a key $k$. The simplest way to construct a keyed hash function out of a regular one is to prepend the key in front of the message: ...


2

Keccak uses a sponge construction to output arbitrary length hashes. This is a distinctly serial operation. Although the inner permutation can be perfomed with a certain level of parallelism using bit-slicing, it is faster in software using native 64-bit operations. P is the message input per block, z are outputs, and f is the inner permutation. In order ...


2

A "cryptographic" hash function commonly has to fulfill two properties: It is collision resistant, meaning that there is no efficient (probabilistic polynomial time adversary), who can find two different messages that map to the same hash value It is compressing, meaning that takes a 'long' string and outputs a shorter hash value. Simply encrypting a ...


2

There are arguments for both sides: Yes, you can. In Feistel networks, the $F$ function is always evaluated in the same direction, not need for inversion. Similar constructions work as well. Or just XOR a hash value to your message (like in a stream cipher, but block-wise), and make the hash value dependent on the key (and any other input of your choice). ...


2

There are no known dangers or attacks from this construction. I agree with the quote from the TAHOE-LFS paper. I would find it quite surprising if this use of the key material introduced some special weakness. I can't prove it, but based upon my professional judgement, this is probably far from the biggest risk to your security -- it is very unlikely that ...


2

The usual recommendation is ECDSA, or if you need a really short signature, BLS. See “Security.SE: What asymetric scheme provides the shortest signature, while being secure?”, “Security.SE: How to encrypt a short string to a short ciphertext using an asymmetric encryption?”, and “Crypto.SE: Short length asymmetric encryption?” for details. ECDSA should ...


2

generate a random number that users can later verify was not fixed/influenced in any way by me. There's no way to do that on your own. But you can ask users to contribute to the seed, eg. Generate a seed $s$ Commit to $s$ and send commitment to the user User generates his own seed, $s'$ and sends it to you Combine (eg. XOR) the two seeds together. ...


2

From what I see from the pseudocode, it would appear that $OPF(n)/stepsize−n \in \{0,1\}$, that is, an attacker can compute $OPF(n)/stepsize$, and rederive $n$ with a maximum error of 1. It would appear that the function fails in its goal of "the adversary must not be able to guess the location of the points"


2

Issues with the question first: Security is not something you can duct tape on to anything you want after the fact. You can never increase information entropy by processing data. It can be kept constant or decreased depending on whether you are doing a lossless or lossy tranformation. HASH("secret"+"public") is not necessarily secure for all crypto-hash ...


2

SpookyHash is clearly designated by its authors to be a non-cryptographic hash. In the cryptographic world there is simply no room for semi-broken at this level. Either there is some kind of margin to reach, say 128 bit security level or there isn't. This means that it should stand up to the current known attacks and that the design conveys enough piece of ...


1

As far as I know (which, admittedly, might be limited; I do not claim to possess encyclopedic knowledge of attacks on KDFs), there are no known practical attacks against KDF0 or KDF1 (which this page, following ISO-18033-2, seems to call KDF1 and KDF2 respectively) when instantiated with a secure hash function. Regarding the relative security of these KDFs ...


1

It is safe, in the case that you have MACs which are independently keyed (or at the very least, the cryptographically secure MAC is independently keyed from all the other ones). This can be seen not by an argument from randomness, but from a simple observation that it were not true, then an attacker could attack the secure MAC by generating the insecure ...


1

By inventing your own random number generator, you are chasing a red herring. There is no need whatsoever for you to invent your own RNG. Combining cryptographic primitives on your own is exceedingly dangerous, and worse, there's no actual need to do so. Unfortunately, if you are only choosing 10 numbers between 1-100, there are only $100^{10}$ possible ...


1

With your clarification edits it is clear what you are looking for. Generated Value = SHA512(A || B || C) Where A = 512 bit secret Where B = x bits server seed and can be attacker chosen Where C = x bits client seed and can be attacker chosen The thing I am curious about is if it's possible for end-user to guess secret seed if he is given ability to ...


1

Ferguson and Schneier define SHAd-256 in their book Practical Cryptography in Chapter 6.3.1 Length Extensions. For any hash function SHA-X, where X is 1, 256, 384 or 512 we define SHAd-X as the function that maps m to SHA-X(SHA-X(m)). In particular, SHAd-256 is just the function m ↦ SHA-256(SHA-256(m)). They clearly defined SHAd-256 to prevent length ...


1

In "Applied Cryptography" by Bruce Schneier, section 14.11, “Using One-Way Hash Functions”, he shows how to use a hash function as a block cipher in CFB mode: $$ C_i = p_i \oplus H(k || C_{i-1}) \\ P_i = Ci \oplus H(k || C_{i-1}) $$ Schneier continues: The security of this scheme depends on the security of the one-way hash function...While these ...



Only top voted, non community-wiki answers of a minimum length are eligible