Tag Info

1

Most hashes are built from permutations (either keyed permutations/block-cipher, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of the inputs. Once you have a good random permutation, you can easily build a hash from it. See Construction of One-way compression functions from block ciphers on ...

3

There are a bunch of problems with this protocol. First of all, the way you generate your RC4 key (concatenate a secret key with a public nonce) is known to be weak. The one thing that saves you is that you only do it 256 times before generating a fresh secret key; however it is known that if you were to do it, say, 2000 times with a secret key, you would ...

2

Yes, the internal word size of a hash algorithm has some significance, pretty much for the reasons given in the question. Algorithms with 64-bit word size have a (typically sizable) performance edge on 64-bit machines (more precisely: for large messages, and comparable implementations, the ratio of the number of bytes hashed in a given time over that for a ...

0

I will keep my answer short. Yes it is trivial, in order to verify the code you need the parameters AND the key, thus there is no easy way to keep the key secure except through a hardware security module. The correct way would be to use a digital signature: Sign(SHA256(parameters),secret_key) The signature can be verified by anyone with the public key, ...

1

Simply put, you need to first understand why that code is bad. You also need to know what preimage resistance is. The comments tell you the algorithm, you don't even need to read the code. // Pad the String with spaces so that it is a multiple of 4 characters // XOR each consecutive 4 byte block This is not cryptographically secure, or even secure from a ...

3

I'm not sure if you want to model existing hash functions with a general model, or invent a new one. The usual general definition of hash function is a function which takes a variable length input bit string and produces a fixed length output bit string: $h : \mathbb{Z}_2^* → \mathbb{Z}_2^n$ ($n$ being the output length). All real-live hash functions I ...

0

One thing you can do if you are not too concerned about losing some entropy is this: For the numbers 0 through 9, divide them evenly into two groups. Assign a 0 bit to any number that occurs in the first group, and a 1 bit for any number that occurs in the second group. For example: 0 = 0 1 = 0 2 = 0 3 = 0 4 = 0 5 = 1 6 = 1 7 = 1 8 = 1 9 = 1 Or you might ...

3

The threat model of password storage is that of server compromision, where the attacker gain access to the database and server code. The attacker can then run the code to test password candidates, possibly making modifications, porting to faster platform, etc. The attacker will not bother computing the fake hash and fake salt. So this scheme is twice as ...

1

I would have made this a comment, but I don't have enough reputation points. I think this is a good question. I don't see how a timing attack could be done in any practical manner. I ran a quick test on two 256 bit/32byte keys I generated. I did a simple "for" over them, comparing each character. Here are the results of my testing. LAST BYTE ...

1

If the resulting hashes were the same, a non length-constant check would compare every byte of the resultant digest. This would take the most time to compare. Lets say it takes 90.00ms to run the KDF, and 0.90ms to do a full length compare (not real numbers but good enough for the example) If the password was "hello" instead of "Hello", it is probable that ...

5

Baring an improbable tremendous theoretical breakthrough, any odd of any kind of collision among SHA-512 hashes, for any cause except identical input or computing failure, is negligible in practice; we'll thus handle this from a theoretical standpoint. Let $s=512$ be the hash width; $k=1000$ the number of hash iterations; and $q>0$ the number of stored ...

2

a Using a moderate number of iterations is a standard approach in password based key derivation (see for example, http://en.wikipedia.org/wiki/PBKDF2, RCF 2898 http://tools.ietf.org/html/rfc2898). It can also be used in the sceanrio described. In this case if an attacker gets access to your password database it should slow down the attacker by a factor ...

0

The parameter $k$ appeared in the definitions of hash functions, since many properties are difficult to formulate for a single concrete hash function. For instance, what would it mean that SHA-256 is collision resistant? Clearly, there are values that collide, and there exists a very short algorithm that outputs a collision in a small constant time. To ...

3

A possible deficiency is that if the use made of any $K_j$ allows it to leak, all later security is lost. That makes $K_j$ plain unsuitable in some uses, e.g. directly as keystream for short messages. The $K_j$ must be wide enough that it is extremely unlikely that a cycle is ever reached in deriving them. For plausible parameters that translates to ...

2

Your proposal is theoretically sound. If an attacker gets $K_5$ the only way to get previous keys would be to "rollback" the hash. If the hash function is secure, this should not be feasible. You could probably even prove it using the random oracle model, for example.

1

Security properties of hash functions are generally concerned with collision resistance, but preimage resistance is also important. For most common hash functions with an $n$-bit digest size, a successful preimage attack has generic $2^n$ maximum complexity, and a successful collision attack has generic $2^{n/2}$ maximum complexity. Most common hash ...

1

Hashes should work on any number of input bits (almost all I/O parameters in cryptography are defined in bits). The output size for collision resistance should be twice the security level. So for a 128 bit level, use 256 bit hashes.

1

While trying to reverse the 'hash' that was mentioned in one of the comments, I discovered the real problem. In short, the problem of finding the valid garbage is bigger than the problem of finding the input. That is, the procedure is correct, but it makes the problem more difficult than the original. The detailed explanation Suppose you are trying to ...

1

Your basic problem is, that your circuit would require infinite many output bits (to be precise, the garbage is infinite). The input for each gate is 3 bit, and you end up with 3 bit. You can duplicate bits in a circuit (by using it as input to multiple gates), but you can NEVER throw away bits or reduce the circuits information. This means, that the output ...

Top 50 recent answers are included