# Tag Info

3

If the checksums (MD5 or SHA...) First things first: there is a BIG difference between a checksum (aka “cyclic redundancy checks” like CRC32) and a hash (aka “cryptographically secure hash functions” like MD5 and the SHA families). The biggest difference between checksums and hashes is that checksums are neither build, nor meant to be ...

0

If you have the hash of a 700MB file then to reconstruct the file you would have to generate random 700MB files until you found one which has the hash you were looking for. There are two reasons why this wont work well in practice: It will take far too long to get lucky and find a file with the correct hash (the chance of it happening is so low that it ...

0

You cannot recunstruct an arbitrarily long value from a fixed size hash because of the https://en.wikipedia.org/wiki/Pigeonhole_principle

1

A clear cut answer to your question is NO for now. In the literature there is no an accurate and reliable scheme that can determine geolocation of the data. They are basically timing-based schemes and the problem with timing (in this case) is that many factors can affect it. Also they usually assume that there are some reliable landmarks around the world ...

1

Watson et al. describe in [1] a Proof of Location scheme (PoL), intended for giving assurance that a file, stored by a cloud provider, is indeed located in some particular place (or more specifically, within some distance from a predetermined set of landmarks). This proposal basically mixes a Proof of Retrievability (PoR) and a trusted geolocalization ...

4

The question "why is preimage resistance needed for hash functions" is not really relevant. This is because collision resistance implies preimage resistance. Thus, it is just a fact that if you have collision resistance then you must have preimage resistance. So, instead, I will relate to what preimage resistance is good for at all. In more technical ...

1

There are a lot of other uses for hash functions than signature algorithms. For example, when used as a MAC – whether directly or in HMAC – a preimage attack would recover the key and allow forgery for arbitrary messages. Even specifically in signature algorithms there's the Lamport signature which requires preimage resistance.

2

So your idea is to effectively turn the password authentication into a key-based authentication by deriving the machine passwords from a single random key stored elsewhere. Assuming key storage is secure (probably encrypted with a strong password), this is sound. It would be better to just use the asymmetric key-based authentication built into most remote ...

0

Yes. ​ I believe this is the standard conversion. (That link is to the paper "Universal One-Way Hash Functions via Inaccessible Entropy".)

5

NMAC is really just an "education tool" on the way to HMAC and I don't think anyone intended it to be used. The two keys are needed since the first and second hashes have different purposes. The first hash on the message is just needed to get collision resistance, whereas the second hash is supposed to provide a pseudorandom function type property. As such, ...

4

MQV has been standardized by IEEE P1363 (specified in P1363 2000, and amended in P1363a 2004), but it does not involve hashing, and therefore can't provide an answer to the OP's question. HMQV standardization proposal has been submitted to IEEE, but it does not contain the specific details that @jww is asking for. I went through the relevant P1363 docs and ...

6

Yes, you can certainly do this, and there has been a lot of theoretical work in the area. At a high level, what this is called is a randomness extractor (Wikipedia): A randomness extractor, often simply called an "extractor", is a function, which being applied to output from a weakly random entropy source, together with a short, uniformly random seed, ...

2

First things first: a PRNG (Pseudo Random Number Generator) can not provide a one-time pad. As a reminder: a one-time pad… has to be truly random, must be at least as long as the plaintext, is never reused in whole or in part, and is kept completely secret. Only when all four points are met, we´re talking about OTP. Your PRNG idea fails to meet those ...

0

The hash can only be calculated once you know the plaintext (and, in your case, the Random Text as well). If you already know the plaintext there is no need to know the key anymore. So basically you have a scheme here that either offers no security at all, or a scheme that is impossible to decipher, even for the intended users (apart from guessing the ...

1

As long as the public knows how the hashes were generated, a forger could substitute his own malicious code and cook up a totally valid hash for it, so that it would look legitimate. So it appears that this [...] has really no way of assuring anything meaningful. You are right that a human attacker able to modify the contents of a website could ...

3

Hashes are useful when the source of the hash is trusted. If you know that you have received the correct hash from a trusted source, and if it is a strong hash (which SHA-2 is), then the hash lets you be sure the file you receive from any source is the same as the file that the person you got the hash from had seen on their end. Length-extension attacks are ...

2

Hashes are not intended to be used against an active attacker, that's what signatures are for. Hashes are often provided alongside programs so that the integrity of the downloaded file can be verified. Users with unreliable internet access could get a corrupted file, having a hash allows them to easily verify that the download succeeded. Some protocols, ...

7

Well, if you can assume that the website hasn't been hacked, then providing a SHA2 hash of a program would allow you do make sure you downloaded (from anywhere on the internet) a good version of the software. You are right, however, that since the method is publicly known, if someone can replace the binary on the site, they can also replace the hash on the ...

9

Contrary to your assumption, this is done, and it is secure: For instance, the hash functions SHA-224 and SHA-384 are basically the same algorithms as SHA-256 and SHA-512! The only differences are in the initial values for the Merkle-Damgård construction used internally and, of course, in that only the first $224$ or $384$ bits of the resulting hash are ...

4

MD5 was designed with the goal that any change in the input uniformly affects all the bits of the output. It's not perfect, but it's pretty good. If you're choosing the input "randomly enough" (e.g., by appending random bits before hashing) then your question approaches this one: Given two randomly generated 8-bit strings, what is the probability that ...

1

No it isn't a good way of salting and it isn't the standard way either. There is no reason or benefit to store the salt before it is used. The point of salt is just to prevent parallel and precomputation attacks. Storing it ahead of time means in an undetected compromise the attacker would learn of 'future salts' which undermine the precomputation ...

0

Let us ignore all kinds of encoding or protocol details. We are looking for some string such that $yourprogram(string)=h$, where $h$ is a specific hash value. You will try to crack that password, rather than SHA-256. Let us assume that all the possible messages you have are the 26 lowercase letters of English alphabet. That means that, for every letter in ...

5

There are attacks on both blockciphers and hash functions that can exploit symmetry in the round functions. For example, completely identical round functions can permit Slide Attacks on Hash Functions, and rotational symmetries of the round function can permit rotational cryptanalysis. The round constant addition or 'iota' step of the Keccak Hash Function ...

5

As Gerald Davis explained in the other answer, there are about 6 million possible passwords, which is way too few. However, there's an additional weakness: since the password and salt are combined with XOR rather than concatenation, it is sufficient to generate a table for all hash values. If you know the $x$ for which $H(x) = h$, you know that the password ...

6

Possible password search space = $36^5$ = 6.05 million possible combinations or ~$2^{26}$. If the passwords were randomly generated it would be 26 bits of entropy which isn't just weak it is pointless. To put that into perspective the throughput on modern GPUs is on the order 1 billion SHA-256 hashes per second. So the exhaustive search time to break an ...

1

KDFs like PBKDF2 are a work multiplier but they can't get blood from a stone. A PBKDF2 using 10,000 rounds "slows" the attacker down by requiring each "guess" to take 10,000 hashes instead of 1. The problem is that passwords like the ones you described are so weak a 10,000x increase in cracking time is like going from 1 ms to 10 seconds. It really isn't ...

4

Would this help preventing brute force attacks? It would slow down an attacker and prevent them from trying as many password guesses. E.g. if you used 1000 rounds like in RFC 2898, you would reduce the number of guesses by a factor of 1000. Assuming you count dictionary attacks under brute force attacks, such attacks would definitely not be completely ...

1

I think that you may be referring to hash functions with (not secret) keys as presented in any theoretically rigorous text on cryptography. In practice, hash functions do NOT have keys. However, if you try to define collision resistance without keyed hash functions, then it is impossible to achieve. This is because there always exists an adversary who finds ...

Top 50 recent answers are included