Tag Info

New answers tagged

3

Is there any work done to show or prove collision resistance gained by increasing digest length? Actually, as CodesInChaos has mentioned, the variable length versions of Keccak ("SHAKE128" and "SHAKE256") are known not to have any collision resistance beyond their security level, independent of how long we make the output. So, what's the point? So, as ...


1

The answer is in the CEN-EN 14890-1:2009, 7.3 General Aspects, and in the SHA-1 and SHA-2 specifications. The output of the hash algorithm for both SHA-1 and SHA-2 is the state of the hash algorithm (specified by $H^{(0..N)}_x$), after the last block is processed. So the output size is identical to the running state, possibly truncated to the leftmost bits. ...


4

What you are describing is essentially the same things as a hash list. A hash list is a sequence of hashes over which another hash is calculated. Your scheme does the same thing after sorting. The sorting won't matter for the security of the scheme; it won't increase the chance of collisions. Hash lists are also used for a well known structure called a ...


1

My personal opinion: "proven secure" is more of an advertising slogan than anything else. The one-time pad and certain multiparty protocols can be shown to have some kind of information-theoretic security; these are exceptions to the rule. "Don't roll your own crypto" is still sensible advice however. For the rest of this discussion, I'll try and stick to ...


1

Is it necessarily a peer review process? Does an algorithm need to withstand exploit attempts for N amount of time by M many experts? Or, is there a mathematical proving process that security experts can apply on their own to evaluate an algorithm? Yes, yes, and sometimes. Some algorithms can be proved secure under certain assumptions. However, ...


3

The Secure Hash Standard and corresponding FIPS-180/202 do not specify any hash to meet a security requirement above 256-bits (using a 512-bit hash). This is unlikely to change. SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general ...


1

Note that for Rainbow tables you should use different reduction functions for each column. Once you have a match on chain endpoint, you should get the start point of this chain and regenerate chain up to hash value you're looking for. This will give you the plaintext you're looking for. To search for a matching chain, you guess the column $i$ where you ...


8

No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.) If you think large quantum computers will be efficient, a 512-bit hash makes some sense, but even then a 1024-bit one wouldn't. A quantum computer requires ...


1

It depends on what properties the compression function has, which in turn depends on how the hash function was constructed. In hash functions based on the Merkle–Damgård construction, the compression function is required to be collision, preimage and second preimage resistant, just like the hash function itself. The only difference is input length: the ...


1

There are good reasons to think an algorithm being in Suite B is evidence NSA thinks it's secure (they are used to protect classified materials). There are also reasons to think algorithms they recommend for others may not be (it's happened before). So I don't think you can objectively say much about an algorithm either way just on the basis of whether it's ...


4

It mainly depends on how the algorithm was selected. If it was selected by a public competition like for AES, then it is likely to be secure. If it was forced in by the NSA such as Dual-EC random number generator, then you may have some doubts. Other questions you may want to ask yourself are: Is this an "original" algorithm or was the problem that it ...


1

If the master key is strong (e.g. random 256-bit key), $c=1$ is fine, or you can use HKDF. A high number of iterations is only needed when you derive the key from a password or other low entropy string. If you can store a 4000 element table securely, you could just use random keys instead of derived ones. If you need the derived key to depend on a low ...


0

As bmm6o wrote in the comments, all encryption is meant to be reversible only when you know the correct key. In the case of symmetric encryption it's the secret key which was used to encrypt the message. In the case of asymmetric encryption it's the private key that corresponds to the public key which was used to encrypt the message. Hashing is not ...


11

MD5 and SHA-1 have a lot in common; SHA-1 was clearly inspired on either MD5 or MD4, or both (SHA-1 is a patched version of SHA-0, which was published in 1993, while MD5 was described as a RFC in 1992). The main structural differences are the following: SHA-1 has a larger state: 160 bits vs 128 bits. SHA-1 has more rounds: 80 vs 64. SHA-1 rounds have an ...


0

In a Merkle Tree, data is eventually and inevitably lost, because it is compressed away. If a Merkle Tree used a non-padded compression function, the size of the resulting hashes would go down level by level, resulting in a top hash that is very short. The shorter that top hash is, the less it CAN say about the contents of its tree. The longer the resulting ...


0

As pointed out in an answer to an older question, SHA-224 is more or less just using the first bits of the output of SHA-256. That is just about the most official construction anyone can find. The XOR approach is however not entirely unprecedented, for example Linux uses that approach on SHA1 in order to generate random bits. There is real security to be ...


2

encrypt it with the message author's private key This statement makes me uncomfortable. Normally, in asymmetric cryptography, one encrypts with the public key and signs with the private key. Did you mean “sign it with the message author's private key”? Otherwise, I would not accept your protocol without a clear, detailed explanation of what encryption ...


3

In general signature creation contains the hashing part within the algorithm. A signature algorithm may also contain a padding mechanism such as PKCS#1 v1.5 or PSS for RSA. Finally it contains a one-way trap door function (modular exponentiation within RSA). Encryption has other requirements, and uses a different padding mechanism. Basically you are ...


2

A symmetrically encrypted hash is not a secure MAC. You should use either an authenticated encryption scheme or a secure MAC in encrypt-then-MAC. With asymmetric encryption, it may be secure – "encrypting" with the author's private key means you are actually signing the message which is fine. However, you need to use the actual asymmetric primitive, not ...


1

There is some confusion in your question, because a signature in a public key cryptosystem is (usually) not just a hash, but a hash of the message that is signed using the private key. E.g. in RSA it would be a hash value padded and raised to the private exponent. There are two ways to have an authenticated encryption in a public key system: Should we ...


5

SHACAL-2 is a block cipher. One way compression functions are typically using block ciphers as a building block, but add some simple operation that make the function one way. In the case of SHA-256, the compression function is SHACAL-2 in Davies-Meyer mode. SHA-256 in turn, consists of this compression function with Merkle-Damgård padding and chaining. ...


0

I would have made this a comment, but I don't have the reputation points. For some background information, the actual encryption key is the one you see when it asks you to move around your mouse when you are setting up encryption. That key is encrypted with your password, as has been stated.


2

I don't see what you want to accomplish. Since there is randomness involved, it's not something that lets you deduce the passwords on another computer if you don't have the 1000 digit random number. Thus, you need to take the random number with you in a secure container (or transmit it in some other safe way). In that case, you might as well just store and ...


4

I worked on a browser extension similar to what you are proposing for a tech company. There's also a project out of Stanford called PwdHash. Such schemes are nice, because they do increase the entropy of the generated password and make dictionary attacks more difficult. The main problem I ran into were pragmatic ones. The solution works 99% of the time, ...


8

What Richie Frame describes above is correct. This is how most FDE solutions work. A new random encryption key is created whenever new container is created or disk is encrypted. That encryption key (often called Master Key) is then protected by users' password. In case of Truecrypt, master key is stored in volume header (link) and volume header is encrypted ...


8

I don't see any obvious security problems in your approach. You can look into key derivation functions, that can provide some additional security in case one of the following occurs: Your password leaks Your secret number leaks A weakness is identified in the hash function There is a few usability issues, that would have to be addressed as well: ...


6

There are some attacks on hashes keyed with a secret suffix. The proper primitive for deriving a secret from keys/passwords and an identifier is a key derivation function. In your case, if the secret number is random a fast key derivation function, like HKDF, would be enough to expand the key into several site-specific hashes. In that case there's no need ...


3

If you need a MAC, use a MAC. For example, HMAC which uses a hash function. Don't try to use a random hash function in your own scheme, because some such schemes are not secure. Reason to use/not use this data as input to the hash? (In the context of authenticity of data…) If you do have a secure MAC, any constant data will not affect the authenticity. ...


1

Assuming $\oplus$ denotes XOR and $+$ denotes concatenation, I believe your first requirement would imply that $H$ would be identical for all inputs of same length, which is obviously not secure. The second requirement is better. It would be satisfied if $H$ was linear. I am not sure if the requirement implies $H$ has to be linear, but it does look like it. ...


6

No such function with either property would meet the requirements of a secure hash function; either of those properties would make it easy to find preimages, that is, given a value $H(x)$, you can find a value $y$ with $H(y) = H(x)$. First off, I assume that $n$ is a constant for the hash function; if we were to assume that the first property holds for any ...


19

I sent an email to Ron Rivest and got an answer back. The digits of $\pi$ are used as a sort of random number generator that is used in the Durstenfeld shuffle (see also Knuth vol 3, sec 3.4.2). Below is some pseudocode adapted from the description and code he sent me. S = [0, 1, ..., 255] digits_Pi = [3, 1, 4, 1, 5, 9, ...] # the digits of pi def ...


0

Yes, it's still talking about the case where multiple hashes are needed to get to the key size. It explains that they are taken independently (different contexts) over the passphrase (the data). For example, with a 160-bit hash (e.g. SHA-1) and a 256-bit key, you would concatenate $H(p)||H(0x00||p)$, then take the leftmost 256 bits (i.e. discard the ...


2

Have I missed something? is this really an AONT? An iterated hash doesn't make a secure stream cipher. If the attacker can guess $m_i$, they can calculate $w_i \oplus m_i = H^i(m_0)$, then decrypt the rest of the message by taking hashes of that value. An option would be to use the hash function like a block cipher in counter mode $w_i = H(m_0||i)$. ...


2

The question is well answered by ninefingers, but the question exposes fundamental confusion on the part of Mitchell. The NT Hash is not salted, and it IS PASSWORD EQUIVALENT. There is no need to use the hash to get the password, just use the hash to access the resource! Second, the password must be greater than 14 characters to avoid the LM hash, see MS ...



Top 50 recent answers are included