# Tag Info

8

It is neither pre-image resistant, second pre-image resistant nor collision resistant. It is easy to compute square-roots modulo a prime (assuming, of course, a square root exists, it will half the time). If $p = 3 \bmod 4$, then the simple formula $x^{(p+1)/4} \bmod p$ will work; for $p = 1 \bmod 4$, it's a tad more complicated but still sufficiently ...

4

Yes, it has happened. If you look at the SHA3 hash zoo, there are a number of hashes who has the best attack listed as "2nd preimage". One general place this can occur is if you have a hash function with a weak message compression step, but a fairly strong finalization step. Here, we might not be able to generate first preimages (because we don't know what ...

4

The question errs precisely at the point when it writes: $$\text{and so }H(x')=y.$$ Problem is: that holds for $x'$ matching some garbage $z'$, including $z'=z$, and perhaps other garbage $z'$, but we do not know which garbage (or $z$ unless we know $x$), and I see no reason that it holds for $x'$ obtained from any garbage $z'$ except for trivial $H$; and ...

3

What you (most probably) describe is called a "preimage attack", where the attacker tries to find a message that has a specific hash value. Some related attacks against reduced/weakened versions of SHA-256 are known, but (as far as I know) no such attack was successful against the standard SHA-256 algorithm up to today. So generally, it can be to be ...

2

When the output of the hash function is $n$ bits, then there are $2^n$ possible outputs. For a preimage attack you are given a hash $h$ and you need to find a message $m$ where $h = H(m)$. Since there are $2^n$ possible outputs, the probability of guessing an input that that maps to the given output is $\dfrac{1}{2^n}$. So on average you need to try $2^n$ ...

2

For cryptographic hash functions, there are the 3 definitions of collision resistance, (first) preimage resistance and second preimage resistance. Number 3 is collision resistance, and it is quite different than No. 1 and No. 2, which is due to the birthday problem (also see birthday attack). In No. 1 and 2, the resulting hash value is fixed (once directly ...

1

While trying to reverse the 'hash' that was mentioned in one of the comments, I discovered the real problem. In short, the problem of finding the valid garbage is bigger than the problem of finding the input. That is, the procedure is correct, but it makes the problem more difficult than the original. The detailed explanation Suppose you are trying to ...

1

Your basic problem is, that your circuit would require infinite many output bits (to be precise, the garbage is infinite). The input for each gate is 3 bit, and you end up with 3 bit. You can duplicate bits in a circuit (by using it as input to multiple gates), but you can NEVER throw away bits or reduce the circuits information. This means, that the output ...

1

Assuming the hash is strong, you will not be able to find a preimage any more easily when you know multiple hashes (whether they use the same function or another). In fact, with some hashes you will be able to derive $H(S||K)$ from just $H(S)$ and $K$ (known as the length extension attack), so it can't give you more information. Unless the hash is broken, ...

Only top voted, non community-wiki answers of a minimum length are eligible