# Tag Info

0

Thank you for your answers but I think I found a better method. Take the hash of your input $h(x)$, preferably with random oracle approximation Sample the interval $[2^kh(x), 2^k(h(x)+1)]$ and pick only primes, for each of them Hash it with an universal hashing function $f$ until you find that $f(p)=h(x)$ Write to memory: $H(x)=p$ Done!

5

I don't know of any practical attacks on these schemes that would break collision-resistance or pre-image resistance, but the existence of related-key attacks on AES is still worrisome. The Miyaguchi-Preneel hash construction is better in this sense, because the attacker doesn't directly control anything that goes into the key input. Miyaguchi-Preneel is ...

12

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles. Getting to the ...

5

There are many well known and studied ways of constructing a hash function from a block cipher. A thorough (but reasonably readable for a beginner) treatment of many of the classic approaches, and the security properties of the various constructions, can be found in Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV, which is ...

5

Yes, we can build a hash function from a block cipher, and that's common (although with block ciphers designed for that purpose, when in the following I focus on AES). CBC is not directly appropriate: what would the key common to all the encryptions be? There is no secret in a hash function! One classic method to obtain a hash function from a block cipher ...

2

A "cryptographic" hash function commonly has to fulfill two properties: It is collision resistant, meaning that there is no efficient (probabilistic polynomial time adversary), who can find two different messages that map to the same hash value It is compressing, meaning that takes a 'long' string and outputs a shorter hash value. Simply encrypting a ...

7

For an adversary not knowing the definition of SHA-512 (or just not knowing the 512-bit initialization constant of SHA-512, defined as the first sixty-four bits of the fractional parts of the square roots of the first eight prime numbers), the sequence obtained by \begin{align*} H_0&=\text{SHA-512}(Seed){\small\text{ where }}Seed{\small\text{ is the ... 3 The definition of "random" is something not very clear that deserves some more explanation, like what you expect from the output number sequence. If you want an uniformed distributed sequence you will get it. If you want an unpredictable sequence you won't. If you want a "sequence undistinguishable from random" you won't get it either. 2 Issues with the question first: Security is not something you can duct tape on to anything you want after the fact. You can never increase information entropy by processing data. It can be kept constant or decreased depending on whether you are doing a lossless or lossy tranformation. HASH("secret"+"public") is not necessarily secure for all crypto-hash ... 2 From what I see from the pseudocode, it would appear that OPF(n)/stepsize−n \in \{0,1\}, that is, an attacker can compute OPF(n)/stepsize, and rederive n with a maximum error of 1. It would appear that the function fails in its goal of "the adversary must not be able to guess the location of the points" 2 SpookyHash is clearly designated by its authors to be a non-cryptographic hash. In the cryptographic world there is simply no room for semi-broken at this level. Either there is some kind of margin to reach, say 128 bit security level or there isn't. This means that it should stand up to the current known attacks and that the design conveys enough piece of ... 3 While collision resistance can be defined for normal hash functions like SHA1, for target collision resistance you need a so called keyed hash function, that is a hash function that additionally to a message m also takes a key k. The simplest way to construct a keyed hash function out of a regular one is to prepend the key in front of the message: ... 3 Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified in transit/on storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes ... 0 To keep it simple: authentication = something to indicate the origin and authenticity of a document or message. signature = a form of identification in authorizing a document or message. You can authenticate a document/message by “signing” it with a signature, or you can authenticate a document/message by authenticating the document/message itself (using ... 1 With authentication, only the intended recipient can confirm the authenticity of the message. With signatures, everyone can. 2 You sign a document with a signature. You authenticate a signature (thus proving the authenticity of the document). 0 Here are two alternatives to ECDSA which was already mentioned: RSA-PSS with message recovery -- RSA signatures are at least as long as the modulus. But RSA-PSS with message recovery allows to pack part (or all) of the data you want to sign into the signature itself. Verification of RSA signatures is also pretty fast. If the message you want to sign is not ... 3 That is an absolutely terrible idea, here is why. His algorithm works as follows: Hash the input data Take the length of data (presumably in bytes) TRUNCATE the hash so that the length value in bytes plus the truncated hash is the output length of a standard MD5 hash (128 bits) Here is an example of a 1MB data file being hashed MD5(data) = ... 7 Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? Yes. That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed. How much HMAC-SHA256 is slower than HMAC-SHA1? Those ... 2 There are no known dangers or attacks from this construction. I agree with the quote from the TAHOE-LFS paper. I would find it quite surprising if this use of the key material introduced some special weakness. I can't prove it, but based upon my professional judgement, this is probably far from the biggest risk to your security -- it is very unlikely that ... 2 The usual recommendation is ECDSA, or if you need a really short signature, BLS. See “Security.SE: What asymetric scheme provides the shortest signature, while being secure?”, “Security.SE: How to encrypt a short string to a short ciphertext using an asymmetric encryption?”, and “Crypto.SE: Short length asymmetric encryption?” for details. ECDSA should ... 1 With your clarification edits it is clear what you are looking for. Generated Value = SHA512(A || B || C) Where A = 512 bit secret Where B = x bits server seed and can be attacker chosen Where C = x bits client seed and can be attacker chosen The thing I am curious about is if it's possible for end-user to guess secret seed if he is given ability to ... 2 generate a random number that users can later verify was not fixed/influenced in any way by me. There's no way to do that on your own. But you can ask users to contribute to the seed, eg. Generate a seed s Commit to s and send commitment to the user User generates his own seed, s' and sends it to you Combine (eg. XOR) the two seeds together. ... 1 By inventing your own random number generator, you are chasing a red herring. There is no need whatsoever for you to invent your own RNG. Combining cryptographic primitives on your own is exceedingly dangerous, and worse, there's no actual need to do so. Unfortunately, if you are only choosing 10 numbers between 1-100, there are only 100^{10} possible ... 4 First of all I do not know your implementation, but it seems that you have some basic misunderstandings. Signature: ECDSA(sha256(Data) ) ECDSA is typically implemented in a way that you do not explicitly hash the data prior to passing it to the signing algorithm (but as this might be your own implementation and signing may still work correctly). ... 1 Ferguson and Schneier define SHAd-256 in their book Practical Cryptography in Chapter 6.3.1 Length Extensions. For any hash function SHA-X, where X is 1, 256, 384 or 512 we define SHAd-X as the function that maps m to SHA-X(SHA-X(m)). In particular, SHAd-256 is just the function m ↦ SHA-256(SHA-256(m)). They clearly defined SHAd-256 to prevent length ... 0 I think this is formalized as non mallability of hash functions. However, you do not find it as a requirement e.g. in the SHA-3 competition and I think that practical hash functions are not analyzed in this direction. For non-mallability you might want to take a look at http://eprint.iacr.org/2009/065 4 Theoretically, there are several ways to turn a hash function into an encryption system. However, the Devil is in the details. A cryptographic hash function is a function which is resistant to preimages, second preimages, and collisions. As far as I know, it has not been proven that these conditions are sufficient to build a stream cipher. In fact, what we ... 2 There are arguments for both sides: Yes, you can. In Feistel networks, the F function is always evaluated in the same direction, not need for inversion. Similar constructions work as well. Or just XOR a hash value to your message (like in a stream cipher, but block-wise), and make the hash value dependent on the key (and any other input of your choice). ... 1 In "Applied Cryptography" by Bruce Schneier, section 14.11, “Using One-Way Hash Functions”, he shows how to use a hash function as a block cipher in CFB mode: C_i = p_i \oplus H(k || C_{i-1}) \\ P_i = Ci \oplus H(k || C_{i-1})  Schneier continues: The security of this scheme depends on the security of the one-way hash function...While these ...

2

Keccak uses a sponge construction to output arbitrary length hashes. This is a distinctly serial operation. Although the inner permutation can be perfomed with a certain level of parallelism using bit-slicing, it is faster in software using native 64-bit operations. P is the message input per block, z are outputs, and f is the inner permutation. In order ...

0

Yes, it can. I recently posed a question about this: Hash Based Encryption (fast & simple), how well would this compare to AES? but apparently similar ideas existed before, and there probably many other ways to do it. In my proposal, I simply use the hash function as a deterministic (using the password and block index as seed) yet strong and ...

0

I asked @eranhammer on Twitter and the idea is to protect the URL from tampering.

4

Preliminary: Almost the same article is available for free without breaking any law, nor downloading 5GB (formatting is shifted by at most one third of a page). It is also (as well as all other articles of IACR crypto conferences from 2000-2011) in the IACR Online Proceedings, specifically in the FSE 2008 section, but then you need to subtract about 223 from ...

1

You are looking for secure coin flipping protocols. See the following: How to fairly select a random number for a game without trusting a third party? Verify product without revealing multipliers Proof that lottery does not know outcome of draw A fair peer-based coin-flipping protocol? Is this scheme a provably fair random number generation?

4

Timelock puzzles solve this problem. For instance, consider the function $f(x) = x^{2^t} \bmod n$, where $n$ is a RSA modulus and $t$ is large. For people who don't know the factorization of $n$, computing $f$ takes $t$ squarings modulo $n$. If you do know the factorization of $n$ (the private key), then computing $f$ can be done with $O(\lg n)$ ...

3

You're close with the idea of using an envelope; the standard answer is to use a commitment scheme; this is a scheme where someone can publish a 'commitment' to a value, and then later revealing what that value was. The two essential properties of commitments are: Someone just looking at the commitment cannot tell what the secret was Someone with the ...

2

For cryptographic hash functions, there are the 3 definitions of collision resistance, (first) preimage resistance and second preimage resistance. Number 3 is collision resistance, and it is quite different than No. 1 and No. 2, which is due to the birthday problem (also see birthday attack). In No. 1 and 2, the resulting hash value is fixed (once directly ...

0

There are a couple of reasons why a salted signature would be helpful. It really depends on the particular implementation of a system. For example if your message is encrypted, then signing with a salt could give you a different signature for the same message each time. This can be very important depending on the situation. If the salt was actually ...

0

As both of us recently learned, the public key signature hash algorithm is negotiated completely separately from the MAC algorithm. DSA and RSA use SHA-1, ECDSA uses SHA-2, and Ed25519 uses, um, Ed25519. I'm skeptical that SSH crypto performance will be a serious issue for you. I suspect you would have to be transferring a lot of data on a really bad CPU ...

3

This is an answer to your revised question, although it doesn't seem to make any more sense: Hex is just another way to represent your data. It is neither more nor less secure than the binary representation or any other representation. Its all about convenience when dealing with this numbers. As humans we tend to operate with data encoded in the decimal ...

2

The reason why you see this gibberish is that the key is random and simply interpreting it as a string of characters doesn't make sense and can lead to all kind of mistakes. You should inform yourself about hashes! Once you hash something, you are not able to retrieve the original value, so I would guess you don't want to do that. Hashes are not about ...

5

Because the RFC says so. Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2]. It says the same for RSA half a page down. Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated ...

3

My estimate of the entropy after $i$ iterations is roughly $128- \lg i$ bits (as $i$ grows large). I don't have a proof of this, but I'll lay out my rough back-of-the-envelope calculations below. Here is the general problem: Problem 1. Let $F:\{0,1\}^n \to \{0,1\}^n$ be a random, i.e., chosen uniformly at random from the set of all functions with ...

4

As pointed in the question, with common Merkle–Damgård hashes like SHA-256, $H(key\ \Vert\ message)$ is vulnerable to a length extension attack, where $H(key\ \Vert\ message\ \Vert\ pad\ \Vert\ extension)$ can be computed knowing $H(key\ \Vert\ message)$ and the length of $key\ \Vert\ message$ (with $pad$ trivially determined from that), for any known ...

1

If $H$ is SHA-256, the security of your scheme might be inferred from the assumption that there are no related key attacks against the SHACAL-256 cipher. (This, in turn, is a topic that is the subject of e.g. this paper.) Intuition: Let $K$ be your derived key and define $K_i = K \oplus i$. Let $E_k$ be the SHACAL-256 cipher. In such case, \$H(K_i) = ...

2

Worth reading: Can I use HMAC-SHA1 in counter mode to make a stream cipher? This is basically the same construction with the difference that you don't call it counter mode and don't assume a specific hash function. However, you should read both answers to that topic, because the second one (0 upvotes, not the accepted answer) has a very reasonable quote ...

Top 50 recent answers are included