# Tag Info

7

Grover's algorithm treats the function it is evaluating as a black box and finds, with high probability, an input to the black box such that it outputs a specified value in $O(N^{1/2})$ evaluations of the function. Since Grover's algorithm works on the function as a black box, your modification does not hinder Grover's algorithm at all in finding the ...

7

In the Damgard-Merkle construction for hash function the compression function takes as input a message block and a chaining value. For the first block a particular value, called a initialisation vector (IV) is given. A freestart collision is a collision where the attacker can choose the IV. Even if a freestart collision does not immediately give a standard ...

4

Provably secure cryptographic hash functions are often built using the same sort of operations as what are used in asymmetric crypto. The major problem with these constructions are that they are very inefficient. Also, a lot of these sorts of constructions have finite input domains. Thus, you have to figure out how to extend it to arbitrary length inputs. ...

3

The rotation countsr (together with the order of access of the 4 words of the state) are engineered for fast diffusion, as documented in RFC1321: The shift amounts in each round have been approximately optimized, to yield a faster "avalanche effect". The shifts in different rounds are distinct. The general idea is to move bits to a 32-bit position on ...

3

Generically, this certainly does not work. For example, with RSA, if you take the domain to be ${\mathbb Z}_N^*$ then it's a permutation so is clearly collision resistant but also completely useless. Then, if you take a larger domain, it's trivial to find a collision. For example, take any $x\in{\mathbb Z}_N^*$ and then take $x'=x + N$. It is clear that an ...

2

Well, first of all you forgot one requirement: hashing should be a deterministic procedure (everyone should compute the same hash for the same input) and that one you do not meet with a secure public key encryption scheme. Now you could fix the used randomness to a fixed value. Then I assume you get an inefficient hash function that in theory fulfils all ...

2

That's correct. Here are the padding instructions from RFC1321, the MD5 spec: 3.1 Step 1. Append Padding Bits The message is "padded" (extended) so that its length (in bits) is congruent to 448, modulo 512. That is, the message is extended so that it is just 64 bits shy of being a multiple of 512 bits long. Padding is always performed, even if ...

2

There's actually an algorithm designed exactly for this purpose: generating a sequence of keys from one master key. It's called HKDF (HMAC-based Key Derivation Function, paper here). The algorithm essentially boils down to two steps: Extract and Expand. The Extract step accepts any type of "key material" as input, and outputs a pseudorandom key that will ...

1

Theoretically, since the domain of SHA-256 contains $2^{2^{64}-1}$ different messages and the value set only contains $2^{256}$ different message digests, there must exist at least one possible output that has more than one possible pre-image. Another important point is that SHA-256 is a deterministic function. This means that if you hash the same message ...

1

Your idea violates rule 1. With asymmetric key encryption, it is not difficult to find a message given the encrypted message, if you have the private key. Also, if you randomly generate a number and call it the public key for a hash function, this is diverging significantly from public private keypair generation, which generally relies on finding two ...

Only top voted, non community-wiki answers of a minimum length are eligible