# Tag Info

5

Basic Building Blocks of a Hash Function The part of a hash function that leads to the digest always being the same size regardless of input length is called the compression function. The compression function is then linked with a domain extender which extends the compression function to allow it to map across any length of input. Construction From Block ...

5

A length extension attack doesn't let you find a collision. It lets you predict the hash for an input with an unknown component in the prefix. If you have $h = H(x)$ for unknown (or partially unknown) $x$, you can generate $h_y = H(x \vert\vert y)$ for arbitrary $y$ (this is not strictly correct; I've ignored padding, but for the purposes of this discussion ...

2

This answers a comment to Stephen Touset's fine answer. With SHA-256, or any collision-resistant hash, no known attack (including length extension) allows producing a file different from the original file and that has the same hash as the original, even if an adversary could choose the original. Even with the practically-broken MD5, or the broken SHA-1, no ...

2

Consider that I, as an attacker, suspects what you're sending in your secret messages. If what you propose were possible, then I could know your plaintext by comparing my encryption of what I thought you were sending to what you actually sent, and brute for variations until I could confirm what you had sent. This would be VERY bad. Therefore, I assume you ...

2

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker. The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands cores will need (but don't have) ...

2

Your key derivation function is not particularly memory hard. The second loop walks the array in order, so an optimized implementation which an attacker would use can avoid the whole array, keeping only some elements in memory at a time. For example, you can halve the memory use by only storing the second half of M initially. Then for the first N/2 ...

1

Unless a fast AES is available on the combination of CPU and PHP instance being used (that is, something built with AES-NI), I strongly advise against using AES as the basis of entropy stretching. Number-1 rule in designing an entropy-stretching function is that it should put to the best possible use the computational resources available to the legitimate ...

1

That's a simple substitution cipher. Base 64 uses the following alphabet A-Za-z0-9+/. Here A encodes 000000, B encodes 000001 etc. In your case the g encodes 000000, P encodes 000001 etc. Instead of writing your own decoder for that you can simply take the ciphertext, iterate through the characters of the ciphertext and replace g with A, P with B etc. After ...

1

Yes, this is known as convergent encryption. The usual way to do it is content hash keying, where you hash the plaintext, then use that hash as a key for deterministic symmetric encryption. You get authentication "for free" by checking that the hash matches, though that means the ciphertext is unauthenticated and you probably want to avoid modes like CBC ...

1

What you're asking for is akin to multiplication, which is just repeated addition. As we know from our grade school classes, these are reversible with subtraction and division. My understanding of the current state of the art is that in order to make it not trivial to reverse, it requires the input of previous state to generate next state--each subsequent ...

1

Recall that randomly chosen functions, used to model good hash functions, are collision resistant if we need on the order of $2^{n/2}$ queries in order to discover a collision with success probability a constant bounded away from zero. Proof by contrapositive: Assume $h$ is NOT collision resistant. Then we can find such collisions much faster than ...

1

Answering the most general interpretation first, yes, it is possible for some piece of data to take the state to some known state. This is because the compression function that moves from one state to the next necessarily has collisions, because its inputs are larger than outputs. For most states you would expect a single block of data to be enough to take ...

Only top voted, non community-wiki answers of a minimum length are eligible