# Tag Info

2

I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer. That one is largely correct, although more bits doesn't have to mean "less-efficient" as for example Skein-512 ...

0

Unfortunately your question doesn't fully specify the authenticated-encryption mode. In particular, AES is a block cipher, not a mode of operation, and only operates on plaintexts of some fixed length (128 bits for AES). So you need to fix a mode-of-operation for AES, such as CBC mode or CTR mode. (Never use ECB mode.) Let's assume you used CBC mode. Then ...

0

This scheme is similar to bitcoin HD wallets (bip32) which have now been in use for several years, and holding millions of dollars worth of funds, ie. they have come under attack, by determined and resourceful attackers, but to this day, they are still considered one of the most secure solutions, and all high security hardware wallets us that approach. So ...

0

SHA-256 is a relatively poor way to store passwords but it is considered to be pretty much impossible to "crack". That is, retrieve the original plaintext from the hash. The reason it is poor to use for passwords, especially without a salt, is due to the fact that it is inexpensive to compute, thus more vulnerable to brute force and rainbow tables etc. ...

0

Remember that a hash function does not create entropy (it can make it very hard to detect a lack of entropy though). Therefore, if the input has 128-bits of entropy, the output has 128-bits of entropy as a maximum. If the output size is 256 bits, then each output bit has $0.5$ bits of entropy. Taking $1/2$ the output bits will cut the entropy in half. To ...

3

The question is how much is this schema secure? Not significantly more secure than sha256(m + k) is and may be less secure. An attacker who could arrange a collision for that would trivially also get a collision for the bcrypt hash of that, regardless of the salt value. While SHA-256 is collision resistant, there are MACs that have better bounds, like ...

4

Although your scheme is secure - especially with a random key of 32 bytes or higher - it won't offer any benefit over HMAC. It's therefore not recommended to use such a scheme. Also note that `bcrypt has been designed for key stretching which is deliberately not efficient. You have ample entropy in your key so there is no need for key stretching.

3

TL;DR: The zlib output is at least as unique as the SHA-256 output. Compression libraries like zlib have to encode the data in such a way that it is recoverably, which implies that they can not reduce the uncertainity (entropy) of the data. Because of this logic, the entropy of the encoded hash has to be the same as the one of the hash. Now as hashes tend ...

1

Which parameters are suitable for your system depends on what execution time you accept. Higher values increase the security - but also the execution time. The default parameters for scrypt are N=16384, r=8, p=1 (16 MB memory). But this recommendation is now 6 years old and custom hardware has evolved. If the execution time is not an issue, it would be ...

-1

If you want to ensure both files are the same, you'll have to resort to comparing them byte-per-byte. Using a hash algorithm is usually used to (try to) ensure that a file that is supposed to be correct has been correctly transmitted to its destination. You know the hash of the correct file, and if the file you got from a reputable source and the right file ...

1

You can do either and the method works. Depending on which value is stored you check for existence in the table at different points in the computation. If the chains are long enough, the addition of a half step does not matter much for time, especially as the reduction function is typically very fast. However, when you are trying to break a key with a size ...

16

As Richie Frame noted in the comments, you basically listed them in order of ascending collision resistance. The latter hashes have greater collision resistance due to their increased output size. With the exception of SHA-1 and MD5, this is denoted by the number in the name of the algorithm. For example, SHA-512 produces 512 bits of output. The size of ...

0

Every 10 min S1 publish the hash value of PS+the current time which is used as public identifier (PI). Every one can see the value of PI in the internet. As S2 has the value of PS, he also use MD5 to get the hash value of PS+the current time and compare it to the value published by S1 and therefore identify that the value provide from S1. Essentially, ...

10

So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security? PBKDF2, yes, pretty much. The only real difference is that salt/password are used the other way around, with the password mixed in at every step. Bcrypt, however, is different. In your case an attacker only needs a small amount of memory compared ...

-1

It may be a contentious issue, but there are those that would categorise a Pearson hash as being of cryptographic strength. The basic hash is 8 bit based (or I guess 16 bit if you go for a much bigger lookup table), and it's output is uniformly distributed. There is also a technique outlined in Pearson's paper to extend the hash though repeated looping to ...

4

Your first sentence is entirely wrong. A OTP is a theoretical construct that requires a fully random key (at least) the size of the plaintext. Limiting the amount of random bits to 256 will by definition not be an OTP - at least not for constructions that accept a plaintext larger than 256 bits. The same idea is that if you use a key called $i$ which is ...

1

No, having multiple hashes will not make determining the secret which was hashed any easier.

3

Well, let's start from the beginning then. The string "Hi" is actually encoded as {0x48,0x69} (as per the ASCII table), so a string-number array conversion is as simple as a bunch of table look-ups. Now converting between hexadecimal and binary and back is easy. Just note that each hexadecimal character corresponds to exactly four bits in binary (because ...

4

Your scheme is likely sound as the SHA-256 hash limits the input to the MD5 hashing function. If this was not so it could be possible (though very hard) to create a collision because of the break. Generally it is more secure to simply use the 128 leftmost bits of the output of SHA-256. SHA-3 - or rather SHAKE256 - would be even better if available. Keep in ...

2

Select $x=(x_1,...,x_{n-1})$ at random and then compute: $$x_n=({a_n}^{-1}\cdot(0-\sum_{i=1}^{n-1}a_i\cdot x_i)) \bmod N$$ Now, select $x'=(x_1',...,x_{n-2}',x_n')$ at random and then compute: $$x_{n-1}'=({a_{n-1}}^{-1}\cdot(0-a_n\cdot x_n'-\sum_{i=1}^{n-2}a_i\cdot x_i')) \bmod N$$ Now we have $h(x)=h(x')=0$. Note that this question was a ...

1

I believe the only way you can do this is to assume you have fixed length inputs to the hash function $f$. Otherwise, it is problematic what probability distribution you'd want to impose on the input set $\{0,1\}^{\ast}$ which is the collection of all finite input strings. In practice, hash functions do have an upper limit on the input string, but that's ...

4

We can easily find collisions for this system. Let $x=(x_1,...,x_n)$ be a sequence such that $h(x)=k$. For finding collision we can do this: Select $x'=(x_1',...,x_{n-1}')$ and then compute: $$x_n'=({a_n}^{-1}\cdot(k-\sum_{i=1}^{n-1}a_ix_i')) \bmod N$$ Now we have $h(x)=h(x')=k$.

3

J.D.'s answer explains why you might want a block cipher in addition to a hash function. TL;DR: versatility. Stream ciphers, however, are not very versatile – at least synchronous stream ciphers are not. Yet they have not been replaced by hash functions. Why? Partly because they have been replaced by block ciphers instead (AES CTR, specifically), but also ...

8

You are correct: The 'workhorses' or primitives of cryptography, hash functions and block ciphers, can be used in such a way that they accomplish each others tasks: A hash function can be used to generate a key stream just as a stream cipher or block cipher in CTR mode (see e.g. Salsa20). And a block cipher can be transformed into a hash function (e.g. a ...

3

It is not collision-resistant because the tag is only 64 bits, so on average only $2^{32}$ inputs are needed to find a collision. This is the classic birthday bound. This is completely insecure, so SipHash is not collision resistant. This is not a problem for hash tables because hash tables have collision-resolution mechanisms and because the odds of a ...

0

The security level of a hash function is determined by its output size. In general, a hash function is considered cryptographically secure when it is collision resistant and provides security level $b = n/2$. Hence, it is not wrong to describe Lamport's scheme that way. However, the description probably was done that way to abstract away some details: If ...

3

Suppose we try C(password) = A(password) + B(password) where + is just concatenation of the hashes. The result of this is obviously a weaker hash: we can preimage C by finding the original password by cracking A or B. This is incorrect with the standard notion of preimage resistance. Because there are many more possible inputs to a hash function ...

1

In general, you never want to use CRC/weak checksum for any computations on secret material (like keys). CRC is a linear function and by showing CRC of a key, you reveal a lot of equations that hold among the key bits. This is equivalent to showing the same number of bits of the key as the length of the checksum. The proper way of doing it has been ...

3

The strength here depends on the collision resistance of $H$. If $H$ is not collision resistant, like MD5, then the attacker can find $H(m) = H(m')$, ask for the MAC of one message and forge it for the other. So for many secure hashes you lose half the security bits. E.g. SHA-256 should give you a 256-bit secure HMAC, but would be at most 128-bit secure in ...

4

Should be comparable in strength to $H(m||k)$. The weakness is that a collision in the inner hash breaks the MAC. Using strong hashes the strength in bits is $\min(2^{n_O},2^{{n_I}/2})$ where $n_O$ is the output size of the outer hash and $n_I$ the output size of the inner hash. But since cryptoanalysis usually breaks collision resistance long before it ...

7

Hexadecimal is traditional -- by this, I mean that there first were command-line tools that used hexadecimal for output, then other people using the hash functions found it fit to stick to hexadecimal, if only to be able to compare their values with the output of the aforementioned tools. That's how traditions get established: a more-or-less random choice at ...

Top 50 recent answers are included