Tag Info

Hot answers tagged

6

The difference is in the choice of $m_1$. In the first case (second preimage resistance), the attacker is handed a fixed $m_1$ to which he has to find a different $m_2$ with equal hash. In particular, he can't choose $m_1$. In the second case (collision resistance), the attacker can freely choose both messages $m_1$ and $m_2$, with the only requirement ...


2

Let's assume that $h(x)$ returns a value between 0 and $k$ (exclusive). If $h$ is a good hash, this distribution will be uniform. Computing $h(x) \mod n$ will introduce a bias if $k$ is not a multiple of $n$. This bias is significant if $k$ is only slightly smaller than $n$ and decreases as $k/n$ grows. How large $k/n$ needs to be depends on what level of ...


2

I don't believe that any such function can meet the requirements of associativity, pre-image resistance and the 'hard to find commuting operands' simultaneously. Here's why: suppose we have a preimage $a$; we first check if $H(a,a)=a$. If it is, we found a preimage. If $H(a,a) = b \ne a$, then we have $H(a,b) = H(a,H(a,a)) = H(H(a,a),a) = H(b,a)$ (because ...


2

Comparing the security of different algorithms isn't easy. But I think the following algorithms would all be fine choices: SHA-3 / Keccak especially with large capacity (say 1024 bits) The biggest problem with this suggestion is that NIST hasn't finalized the SHA-3 specification yet. BLAKE A SHA-3 finalist, which some people (including myself) preferred ...



Only top voted, non community-wiki answers of a minimum length are eligible