# Tag Info

13

Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of the inputs. Once you have a good random permutation, you can easily build a hash from it. See Construction of One-way compression functions from block ciphers ...

6

In hash functions (and similarly block ciphers) each round applies a non-linear function to its input. This function is somewhat difficult to calculate backwards (and it needs a few other properties, but let's leave it at that). This concept is called diffusion. On the other side, one of the goals of cryptanalysis is to reverse this diffusion in order to ...

5

Baring an improbable tremendous theoretical breakthrough, any odd of any kind of collision among SHA-512 hashes, for any cause except identical input or computing failure, is negligible in practice; we'll thus handle this from a theoretical standpoint. Let $s=512$ be the hash width; $k=1000$ the number of hash iterations; and $q>0$ the number of stored ...

3

There are a bunch of problems with this protocol. First of all, the way you generate your RC4 key (concatenate a secret key with a public nonce) is known to be weak. The one thing that saves you is that you only do it 256 times before generating a fresh secret key; however it is known that if you were to do it, say, 2000 times with a secret key, you would ...

3

I'm not sure if you want to model existing hash functions with a general model, or invent a new one. The usual general definition of hash function is a function which takes a variable length input bit string and produces a fixed length output bit string: $h : \mathbb{Z}_2^* → \mathbb{Z}_2^n$ ($n$ being the output length). All real-live hash functions I ...

3

The threat model of password storage is that of server compromision, where the attacker gain access to the database and server code. The attacker can then run the code to test password candidates, possibly making modifications, porting to faster platform, etc. The attacker will not bother computing the fake hash and fake salt. So this scheme is twice as ...

3

A possible deficiency is that if the use made of any $K_j$ allows it to leak, all later security is lost. That makes $K_j$ plain unsuitable in some uses, e.g. directly as keystream for short messages. The $K_j$ must be wide enough that it is extremely unlikely that a cycle is ever reached in deriving them. For plausible parameters that translates to ...

2

a Using a moderate number of iterations is a standard approach in password based key derivation (see for example, http://en.wikipedia.org/wiki/PBKDF2, RCF 2898 http://tools.ietf.org/html/rfc2898). It can also be used in the sceanrio described. In this case if an attacker gets access to your password database it should slow down the attacker by a factor ...

2

Yes, the internal word size of a hash algorithm has some significance, pretty much for the reasons given in the question. Algorithms with 64-bit word size have a (typically sizable) performance edge on 64-bit machines (more precisely: for large messages, and comparable implementations, the ratio of the number of bytes hashed in a given time over that for a ...

2

This is called the diffusion property, and hash functions are explicitly designed to have this property. The reason you want this property is because it makes it harder to find patterns between similar plaintexts and their hashes. Something like SHA-1 is based on a block cipher. This essentially means that hashing involves iterating some operations over a ...

1

As the other answers already allude to, it's a tradeoff between many simple rounds or a few complex rounds. But consider that one of the challenges of crypto design is to make something easily implementable in hardware. A simple algorithm takes not a lot of space on a chip, even when it's run for many rounds. SHA-1 can reuse the same circuitry 80 times in a ...

1

Simply put, you need to first understand why that code is bad. You also need to know what preimage resistance is. The comments tell you the algorithm, you don't even need to read the code. // Pad the String with spaces so that it is a multiple of 4 characters // XOR each consecutive 4 byte block This is not cryptographically secure, or even secure from a ...

1

I would have made this a comment, but I don't have enough reputation points. I think this is a good question. I don't see how a timing attack could be done in any practical manner. I ran a quick test on two 256 bit/32byte keys I generated. I did a simple "for" over them, comparing each character. Here are the results of my testing. LAST BYTE ...

1

If the resulting hashes were the same, a non length-constant check would compare every byte of the resultant digest. This would take the most time to compare. Lets say it takes 90.00ms to run the KDF, and 0.90ms to do a full length compare (not real numbers but good enough for the example) If the password was "hello" instead of "Hello", it is probable that ...

1

Security properties of hash functions are generally concerned with collision resistance, but preimage resistance is also important. For most common hash functions with an $n$-bit digest size, a successful preimage attack has generic $2^n$ maximum complexity, and a successful collision attack has generic $2^{n/2}$ maximum complexity. Most common hash ...

Only top voted, non community-wiki answers of a minimum length are eligible