New answers tagged

0

Might need some clarification, but it sounds like you are wondering how to 'salt' the hash. First if you intend to concatenate the secret key with anything else, the standard way to handle this is a HMAC. A common way to handle this is PBKDF2: https://en.wikipedia.org/wiki/PBKDF2 Basically this does a secure combination of secret codes and the ...


1

Your first approach $H'(m) = H(H(m)) || H(m)$ will not have any improvement collision resistance. The reason being is that a collision in the right half automatically causes a collision in the left half, since the output of $H$ is identical for the colliding messages. The left half is not a function of the message, but of the message hash, the concatenation ...


2

I'm no security expert but I'll take a stab at this since it hasn't been answered. Also, I'm answering as if you're asking about a Rainbow table or Dictionary attack for preimage and second-premiage attacks. Preimage being the rainbow table attack and second-preimage relating to getting similar encrypted values (cipher text) from the same password. If ...


0

To forge a message using a hash collision, you need to generate a signature (using that hash function to sign a "good" message); then that signature is also a valid signature for the "bad" message. So, to prevent this from being a concern, you just never sign a message using MD5 as your hash function. Yes, the attacker can generate a "good" and a "bad" ...


0

In RSA systems one type of attack is based on the multiplicative property of RSA. Suppose that $y_1=\operatorname{sig_k}(x_1)$ and $y_2=\operatorname{sig_k}(x_2)$ are any two messages previously signed by A. then: $$\operatorname{ver_k}(x_1\cdot x_2 \bmod n,y_1\cdot y_2 \bmod n)=true$$ In this case for avoid this attack, instead of message we can sign ...


0

Just as someone uses a public key, they would also display their hash function. The hash function will make the message smaller, and it also adds security so that keys cannot be forged. Adding a hash function to public key crypto is just an added layer of security.


0

First of all signing does not equal encrypting. It only works on some crypto systems and even then it is not the whole picture. Hash algorithms are used for various reasons. One of them is to reduce the size of the signature since the digest is generally a lot smaller than the message itself. But the main cryptographic reason behind hash functions is to ...


0

GMAC, for example, is trivially broken if used as an unkeyed hash algorithm. GMAC is effectively a series of operations on blocks where you take the previous state, XOR it with the next block, then multiply it in $GF(2^{128})$ by the derived secret subkey $H$. That is, for data block $A_i$, the next hash value is computed from the previous one as follows: ...


1

One difference is that with simple concatenation two different salt-password pairs could lead to the same hash input. For example: H('abcd'||'example@example.com') = H('abcde'||xample@example.com). This cannot happen between your password hashes if you use a constant width salt, but could still happen between your password hashes and those of some other ...


1

If I understand the question correctly, you have some sensitive data -- say, a list L of social security numbers in some order -- and you want to somehow create and publish a file D from that list such that If the person has a piece of data S, to query a database D to see if S is in L and if so, the row number where S occurs in L. You don't want some ...


0

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. These 2 images have the same md5 hash: 253dd04e87492e4fc3471de5e776bc3d (If you want to test it yourself, take images from the link below, after uploading ...


3

You are creating a key stream using a hash function. This is often called a stream mode of operation (although it doesn't seem to be a well defined term). This is a known method of creating a key stream. An OTP requires the key stream to be completely random. This is because it would otherwise be possible to brute force the key. If you can brute force the ...


1

While Switch is right about the difference between Merkle–Damgård and Sponge constructions, I don't believe he is correct as to NIST's reasoning. I happened to talk to a NIST cryptographer (John Kelsey) about this. He indicated that they selected Keccak not because they distrust the SHA-2 design (Merkle–Damgård is provably secure if the compression ...


4

The difference is: All SHA-0, 1 & 2 and MD5 come under a class of algorithm called Merkle–Damgård construction, while SHA-3 falls under Sponge functions. Merkle–Damgård construction is a method of building collision-resistant cryptographic hash functions from collision-resistant one-way compression functions. And, Sponge functions are a class of ...


1

I don't believe that it is possible given the requirements you've listed. Let us consider an arbitrary $C, M$ that meets the requirement. To reveal the entire database, what an attacker can do is compute $C(d,s)$ for every possible $d$ (about 4 million, as you said); then, he can use $M$ to compare that to every value you actually have - this reveals ...


3

The right terminology is second preimage resistance and preimage resistance. Edited to reflect comment by otus. Preimage attack takes $O(2^{n})$ hash function calls on average. Second preimage attack takes just one extra call so the complexity is essentially the same as that of the preimage attack. Given $x$ you want $x'\neq x$ such that $H(x)=H(x').$ So ...


1

While it is well known that hash1(hash2(x)) only serves to increase collisions, Collisions essentially do not matter at all for password hashing. You will only lose entropy to collisions if the input entropy is near the size of the hash output. And in that case you are well and truly out of the realm of what can be cracked for any popular hash function. ...


0

There are two ways of going about this: create a hash tree (or, as it is only one deep, a hash list); create a canonical representation of the strings; For the first option you simply hash each string, and then hash all the resulting hashes. As the hashes should not have collisions, you can be certain that the resulting hash doesn't collide either. In ...


0

Yeah, the usual solution for this problem is to prepend the length of each string (in bytes) then concatenate them into one large array and hash the whole shebang. E.g., [john, smith] becomes the string "4john5smith".


2

A password manager that produces 16-character passwords is sufficient for most cases. Users who go for 100-byte passwords are usually overly-paranoid, since the actual security benefit is outweighed by the inconvenience. Therefore, limiting a password to 72 characters, while in theory reducing the number of possible passwords, is still very reasonable. ...


3

Such a category of functions is not generally used as is, but compression functions, which are close to what you describe, are (as you describe) used to build (variable length) hash functions. For example, Merkle–Damgård hashes like SHA-2 have a compression function that takes an IV (or previous block output) and a fixed size data block to generate a smaller ...


4

Consider $$H(M)= 9^{-1} (E(M) - 5M) \pmod {2^n}$$ where $E$ is encryption using a random permutation with an efficiently computable inverse $D$. This is a secure hash for the same reason the Matyas–Meyer–Oseas construction is. Now using your definition of $H'$ we obtain: $$H'(M)=5M+9H(M) = 5M + (E(M) - 5M) = E(M) \pmod {2^n}$$ Thus $M = D(H'(M))$ can ...


0

From your question, I believe that what you are looking for is a proof of storage. I will point you in the direction of one paper, and you can use that to look for other work on the topic.


0

I played with an idea for an asymmetric proof of work scheme that I put a small amount of thought into making parallel resistant. I will explain the basic idea of the proof of work scheme first, followed by how I attempted to make it parallel resistant. The challenge creator hashes a small number of random bytes with a random iv. A desired number of ...


0

The following paragraph applies even if the honest prover does not use iteration. Strictly speaking, only a constant-size part of the input can be read from in constant time, so one could always find a suitable result in constant time. For a deterministic verifier that makes at most k probes to an alleged result consisting of M w-bit words, one can find ...


0

For Feistel ciphers such as DES, encryption and decryption are performed using the same algorithm – decryption simply uses the round keys in the reverse order as encryption. If a hash function was substituted for the round function of a Feistel cipher, then there would be no round keys and encryption and decryption would use the same algorithm – the ...


0

Although I'm certainly not going to recommend using it, one well known way to do this is to hash the previous ciphertext block concatenated with the key, then XOR the result with the current plaintext block. In this case, the block size is equal to the length of one output from the hash function. In effect, is uses the hash about like a block cipher in CFB ...


0

For a simple reason; for verification, the other side needs your private key K. Without knowing the K, no one can generate the 240 bits.


9

Hash functions must be public, so if you want use RSA as hash function you should fix $K$. Now let $n$ be the RSA module and $H$ denote RSA hash function. We have $$H(M)=H(M+n)$$ so this function is not second preimage and collision resistant. Also this system is not first preimage resistant (with known public and private key): Let $M^k=h \pmod n$ ...


1

Given only the information in the original question, it would be easy for an attacker to calculate generate an arbitrary message E, then calculate the Hash("This is message E + ab3ed") = 31415, and if the system can be tricked into trusting that 31415 is the hash of a valid message, there's no way to prove that E isn't really a valid sibling of B. This may ...


0

Your reasoning is correct. Finding a collision will solve the discrete-logarithm problem. This is actually what Pollard's Rho does. If you can find $g^{x_1}h^{x_2} = g^{y_1}h^{y_2}$ then you can compute the discrete logarithm of $h$ $g^{x_1}h^{x_2} = g^{x_1 + kx_2}$ $x_1 + kx_2 = y_1 + ky_2$ $x_1 - y_1 = k(y_2 - x_2)$ $(x_1 - y_1)(y_2 - x_2)^{-1} = k$ ...


1

I would like to extend Chrystographer answer. If this is a part of a incoming or outgoing message, you cannot prove it. Anybody can write valid messages. You need Merkle tree and digital signature of the root's hash.


2

The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/). Roughly they generate a password for each site depending on: Your master password The site name A number (so that if you have to change your password you can just increase the number) Some salts that they decice. And then they ...


4

Is there any problems from using the approach I am suggesting? Yes, there are several. First of all, some sites generate first time passwords, or even long time passwords. You may want to store those too. What if a site requires frequent updates? If one password is reversed, you'd still loose confidentiality. Would it actually be less secure if ...


1

@Jeroba88 your idea of using a hash function rather than just appending the service name to your secret password is simple yet crucial to achieve what you have set off to do. Some level of customisation (be careful), such as using PBKDF2 (or Scrypt) in place of just a plain HASH(Password|Service) (especially since it's probably preferable to use ...


2

There are several different scenarios to consider. If you assume all the sites/apps do things right, use a strong password hash, stay uncompromised, then no one should be able to find your master password anyway (unless it is a very poor low entropy password). So how or whether it is combined at all does not matter. More likely, you are interested in ...


2

Yes, this logic works. You have shown that given the discrete log $x$ lets you easily find collisions. Now you need to show that any collision lets you extract the discrete log $x$ and then you are done (then you have shown the equivalence).


2

How can he do that? He could take api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another padding. This is the idea behind the hash length_extension attack, isn't it? Correct. My question: The api_signature will change then because it is calculated like: md5(extra || padding) with ...


4

MD4 is Not One-Way. The attack described in the 2008 paper is a theoretical attack with complexity $2^{102}$, which is better than the brute force complexity of $2^{128}$. In later theoretical results reported here the complexity dropped to $2^{94.98}$ and here it dropped even further to $2^{69.4}$ for secondary pre-image attacks. Similarly, The MD2 Hash ...


1

Encrypting the salt is actually equivalent to just using the cipher as an initial step. That is, you could redefine the scheme as follows: tmp := D(hash(password), salt) password_hash = F(password, tmp) output := salt, password_hash Where D is the decryption function and F is the actual iterated password hash you defined. The addition of the cipher is ...


2

It all depends on how you define the machine that implements the random oracle. Consider this pseudo code random oracle that uses a hash table: def rand_oracle(input, hash_table): input_hash_key = get_hash(input) if input_hash_key in hash_table: return hash_table[input_hash_key] else: return something truly random You need to ...


5

You are right that if it costs Alice & Bob effort $N$ to agree on a key in this way, then it costs Eve only effort $N^2$ to find it. So the protocol is not secure in the standard sense, and probably not very useful. (Maybe in some highly constrained situation with very short-lived keys?) More generally, this purports to be a key agreement protocol whose ...


9

I'll review the standard mathematical notations used for $H_1:\{0,1\}^*\times\mathbb Z_p^∗\to\mathbb Z_q^∗$ , going from the bottom up. Hopefully, that will make the rest evident. $\{0,1\}$ is the set with the two elements $0$ and $1$, known as Booleans. $\{0,1\}^k$ (for some non-negative integer $k$ ) is the set of tuples with $k$ Booleans, or ...


5

The other answer already explains that what you are looking for is a message authentication code, but did not show a clear attack against your construction. At the very least it seems to be vulnerable to length-extension type attacks, like the keyed hash mentioned: Take the output for some known message, where the length of the key x and message v is ...


6

If I understood your question correctly, you want a message authentication code (MAC). The "hidden input" is usually called key and the "visible input" is just the message. The output of the MAC is called tag (or also MAC). The main security goal for MACs is resistance against forgery: It should be computationally infeasible for an attacker who does not ...


2

If you want to construct a PRF for arbitrarily-long inputs using AES, then just use CBC-MAC (while prepending the message length in the first block). I don't see any advantage in what you are proposing and therefore don't see any point in trying to analyze something non-standard.


0

How about something like interleaving the bits of the base hash function outputs to generate a key (taking one bit from each hash in sequence, skipping hashes that have no unincorporated bits remaining), then generating a HMAC using each base hash function with however many bits of key they can use: $$K(x) = interleaveBits(H_0(x), H_1(x), H_2(x))$$ $$H(x) ...



Top 50 recent answers are included