Tag Info

Hot answers tagged

14

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles. Getting to the ...


7

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? Yes. That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed. How much HMAC-SHA256 is slower than HMAC-SHA1? Those ...


7

For an adversary not knowing the definition of SHA-512 (or just not knowing the 512-bit initialization constant of SHA-512, defined as the first sixty-four bits of the fractional parts of the square roots of the first eight prime numbers), the sequence obtained by $$\begin{align*} H_0&=\text{SHA-512}(Seed){\small\text{ where }}Seed{\small\text{ is the ...


6

There are many well known and studied ways of constructing a hash function from a block cipher. A thorough (but reasonably readable for a beginner) treatment of many of the classic approaches, and the security properties of the various constructions, can be found in Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV, which is ...


5

Is it valid to call this table an S-Box? Not really; at least, not with the meaning we usually give to "S-box". The "S" in "S-box" stands for Substitution; we take the data, and replace it with a value from the S-box (using the data as an index into the S-box). The classical (if not the original) example is the S-boxes within AES; at certain points ...


5

I don't know of any practical attacks on these schemes that would break collision-resistance or pre-image resistance, but the existence of related-key attacks on AES is still worrisome. The Miyaguchi-Preneel hash construction is better in this sense, because the attacker doesn't directly control anything that goes into the key input. Miyaguchi-Preneel is ...


5

Yes, we can build a hash function from a block cipher, and that's common, although with block ciphers designed for that purpose, when in the following I focus on AES, mentioned in the (different) question that motivated the present answer [which got moved here because said question was found to be a duplicate]. One classic method to obtain a hash function ...


4

First of all I do not know your implementation, but it seems that you have some basic misunderstandings. Signature: ECDSA(sha256(Data) ) ECDSA is typically implemented in a way that you do not explicitly hash the data prior to passing it to the signing algorithm (but as this might be your own implementation and signing may still work correctly). ...


4

Theoretically, there are several ways to turn a hash function into an encryption system. However, the Devil is in the details. A cryptographic hash function is a function which is resistant to preimages, second preimages, and collisions. As far as I know, it has not been proven that these conditions are sufficient to build a stream cipher. In fact, what we ...


4

The operation: X[16] & (N-1) is really, mathematically speaking: $$ X[16] \mathrm{\ mod\ } N $$ With a generic $N$, this operation must be done with an actual division, which is expensive; some CPU types don't provide it, and for CPU which do provide it (e.g. x86), it is quite slow (for instance, for 32-bit operands on an Intel Core2, division latency ...


4

As far as I know (which, admittedly, might be limited; I do not claim to possess encyclopedic knowledge of attacks on KDFs), there are no known practical attacks against KDF1 or KDF2 (which are also mentioned on this page, following ISO-18033-2) when instantiated with a secure hash function. Regarding the relative security of these KDFs vs. HMAC-based KDFs ...


3

Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified in transit/on storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes ...


3

That is an absolutely terrible idea, here is why. His algorithm works as follows: Hash the input data Take the length of data (presumably in bytes) TRUNCATE the hash so that the length value in bytes plus the truncated hash is the output length of a standard MD5 hash (128 bits) Here is an example of a 1MB data file being hashed MD5(data) = ...


3

The definition of "random" is something not very clear that deserves some more explanation, like what you expect from the output number sequence. If you want an uniformed distributed sequence you will get it. If you want an unpredictable sequence you won't. If you want a "sequence undistinguishable from random" you won't get it either.


3

While collision resistance can be defined for normal hash functions like SHA1, for target collision resistance you need a so called keyed hash function, that is a hash function that additionally to a message $m$ also takes a key $k$. The simplest way to construct a keyed hash function out of a regular one is to prepend the key in front of the message: ...


2

A "cryptographic" hash function commonly has to fulfill two properties: It is collision resistant, meaning that there is no efficient (probabilistic polynomial time adversary), who can find two different messages that map to the same hash value It is compressing, meaning that takes a 'long' string and outputs a shorter hash value. Simply encrypting a ...


2

generate a random number that users can later verify was not fixed/influenced in any way by me. There's no way to do that on your own. But you can ask users to contribute to the seed, eg. Generate a seed $s$ Commit to $s$ and send commitment to the user User generates his own seed, $s'$ and sends it to you Combine (eg. XOR) the two seeds together. ...


2

From what I see from the pseudocode, it would appear that $OPF(n)/stepsize−n \in \{0,1\}$, that is, an attacker can compute $OPF(n)/stepsize$, and rederive $n$ with a maximum error of 1. It would appear that the function fails in its goal of "the adversary must not be able to guess the location of the points"


2

Issues with the question first: Security is not something you can duct tape on to anything you want after the fact. You can never increase information entropy by processing data. It can be kept constant or decreased depending on whether you are doing a lossless or lossy tranformation. HASH("secret"+"public") is not necessarily secure for all crypto-hash ...


2

SpookyHash is clearly designated by its authors to be a non-cryptographic hash. In the cryptographic world there is simply no room for semi-broken at this level. Either there is some kind of margin to reach, say 128 bit security level or there isn't. This means that it should stand up to the current known attacks and that the design conveys enough piece of ...


2

There are no known dangers or attacks from this construction. I agree with the quote from the TAHOE-LFS paper. I would find it quite surprising if this use of the key material introduced some special weakness. I can't prove it, but based upon my professional judgement, this is probably far from the biggest risk to your security -- it is very unlikely that ...


2

The usual recommendation is ECDSA, or if you need a really short signature, BLS. See “Security.SE: What asymetric scheme provides the shortest signature, while being secure?”, “Security.SE: How to encrypt a short string to a short ciphertext using an asymmetric encryption?”, and “Crypto.SE: Short length asymmetric encryption?” for details. ECDSA should ...


2

According to HMAC definition only one Key is used. The only thing is, the key is outer padded and inner padded HMAC(K,M) = H( (K⊕opad)| H( (K⊕ipad)| M)) H is a cryptographic hash function; K is a secret key padded to the right with extra zeros to the input block size of the hash function, or the hash of the original key if it's longer than that block ...


2

Leaving text encryption and padding questions aside and focusing on the header stuff, here's how I'd approach the problem: FileHeader = { BYTE Salt[16] # Random bytes, K = KDF(Salt, Password) BYTE EncHdr[] # EncHdr = AES-GCM(K, h0...h5) } Salt is a sequence of random bytes (it's there to prevent Rainbow table attacks) EncHdr is the encrypted version ...


1

Tiger is a 192-bit cryptographic message digest (hash function). A design goal of an ideal hash function is to distribute the input entropy evenly over the message digest. If an input string of 40 bytes with 28 bytes (224 bits) of entropy is hashed by Tiger, the resultant 192-bit string will have at most 192 bits, since the output cannot have more entropy ...


1

It is safe, in the case that you have MACs which are independently keyed (or at the very least, the cryptographically secure MAC is independently keyed from all the other ones). This can be seen not by an argument from randomness, but from a simple observation that it were not true, then an attacker could attack the secure MAC by generating the insecure ...


1

With your clarification edits it is clear what you are looking for. Generated Value = SHA512(A || B || C) Where A = 512 bit secret Where B = x bits server seed and can be attacker chosen Where C = x bits client seed and can be attacker chosen The thing I am curious about is if it's possible for end-user to guess secret seed if he is given ability to ...


1

By inventing your own random number generator, you are chasing a red herring. There is no need whatsoever for you to invent your own RNG. Combining cryptographic primitives on your own is exceedingly dangerous, and worse, there's no actual need to do so. Unfortunately, if you are only choosing 10 numbers between 1-100, there are only $100^{10}$ possible ...


1

Ferguson and Schneier define SHAd-256 in their book Practical Cryptography in Chapter 6.3.1 Length Extensions. For any hash function SHA-X, where X is 1, 256, 384 or 512 we define SHAd-X as the function that maps m to SHA-X(SHA-X(m)). In particular, SHAd-256 is just the function m ↦ SHA-256(SHA-256(m)). They clearly defined SHAd-256 to prevent length ...



Only top voted, non community-wiki answers of a minimum length are eligible