Hot answers tagged

3

You are creating a key stream using a hash function. This is often called a stream mode of operation (although it doesn't seem to be a well defined term). This is a known method of creating a key stream. An OTP requires the key stream to be completely random. This is because it would otherwise be possible to brute force the key. If you can brute force the ...


2

I'm no security expert but I'll take a stab at this since it hasn't been answered. Also, I'm answering as if you're asking about a Rainbow table or Dictionary attack for preimage and second-premiage attacks. Preimage being the rainbow table attack and second-preimage relating to getting similar encrypted values (cipher text) from the same password. If ...


1

Your first approach $H'(m) = H(H(m)) || H(m)$ will not have any improvement collision resistance. The reason being is that a collision in the right half automatically causes a collision in the left half, since the output of $H$ is identical for the colliding messages. The left half is not a function of the message, but of the message hash, the concatenation ...


1

To forge a message using a hash collision, you need to generate a signature (using that hash function to sign a "good" message); then that signature is also a valid signature for the "bad" message. So, to prevent this from being a concern, you just never sign a message using MD5 as your hash function. Yes, the attacker can generate a "good" and a "bad" ...


1

One difference is that with simple concatenation two different salt-password pairs could lead to the same hash input. For example: H('abcd'||'example@example.com') = H('abcde'||xample@example.com). This cannot happen between your password hashes if you use a constant width salt, but could still happen between your password hashes and those of some other ...


1

If I understand the question correctly, you have some sensitive data -- say, a list L of social security numbers in some order -- and you want to somehow create and publish a file D from that list such that If the person has a piece of data S, to query a database D to see if S is in L and if so, the row number where S occurs in L. You don't want some ...



Only top voted, non community-wiki answers of a minimum length are eligible