Tag Info

Hot answers tagged

13

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? Yes. That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed. How much HMAC-SHA256 is slower than HMAC-SHA1? Those ...


10

SHA-224, part of FIPS 180 since FIPS 180-3 FIPS 180-2 change notice 1 of 2004, was introduced to match the second of the security strengths {80, 112, 128, 192, 256} defined in the document that became NIST Special Publication 800-57 – Recommendation for Key Management – Part 1: General (Revision 3). That security strength itself was kept ...


8

No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.) If you think large quantum computers will be efficient, a 512-bit hash makes some sense, but even then a 1024-bit one wouldn't. A quantum computer requires ...


6

The main thing that makes HMAC secure in typical use even with MD5 is that it is used with a secret key. That means only preimage attacks are really relevant, since finding a collision is always an online attack if you don't know the key. With known attacks the preimage resistance of both MD5 and SHA-1 is > 100 bits. Additionally, HMAC may be secure even ...


5

What you are describing is essentially the same things as a hash list. A hash list is a sequence of hashes over which another hash is calculated. Your scheme does the same thing after sorting. The sorting won't matter for the security of the scheme; it won't increase the chance of collisions. Hash lists are also used for a well known structure called a ...


5

The Secure Hash Standard and corresponding FIPS-180/202 do not specify any hash to meet a security requirement above 256-bits (using a 512-bit hash). This is unlikely to change. SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general ...


4

It meets the security requirement for 112-bit collision and preimage resistance, while being 32 bits shorter than SHA-256. This may not seem like a lot, but when you have thousands or even millions of hashes or signatures to worry about in a system, those extra 4 bytes add up. Think of a webmail service, where a hash of each email is used for deduplication ...


3

Honestly, in practice, there are very few if any reasons to use SHA-224. As fgrieu notes, SHA-224 is simply SHA-256 with a different IV and with 32 of the output bits thrown away. For most purposes, if you want a hash with more than 128 but less than 256 bits, simply using SHA-256 and truncating the output yourself to the desired bit length is simpler and ...


3

SHA-2, like SHA-1, is an ARX hash function: that is, it uses Addition, Rotation, and eXclusive-or for bit diffusion. The purpose of each one is explained very simply and clearly by Khovratovich & Nikolić in their paper "Rotational Cryptanalysis of ARX", so I will simply quote them here: Addition provides diffusion and nonlinearity, while XOR does ...


2

Does input truncation using SHA-256 expose any potential weaknesses? No, hashing the passphrase with SHA-256 will be no stronger or weaker than feeding it in directly. If you go with Scrypt (which I would recommend you do), there are no restrictions on the size of the passphrase... and Scrypt consumes it internally with one round of PBKDF2-HMAC-SHA256 ...


2

Does allowing users to test VALUEs increase the likelihood that SECRET will be broken or illegal hashed values generated, relative to the CONTROL scenario? By definition a cryptographic Message Authentication Code such as HMAC is secure only if resists existential forgery under chosen-plaintext attacks. i.e. if allowing users to test VALUEs increases ...


2

SHA is related to AES in that they are both US government standards. They are not similar algorithmically. SHA and AES are cryptographic primitives, TLS is a protocol. As the name describes SHA is a family of hash algorithms. AES is a block cipher. TLS uses many encryption algorithms, including AES in various modes, and several hash algorithms, including ...


2

Actually, it's there on the list, just with a different name -- the approved algorithm you want is listed as "SHS" (Secure Hashing Standard). Now, the term "SHS" doesn't distinguish between the various flavors of SHA-2 (and SHA-1, which is still approved for some uses); however if you look at this more detailed list, that gives details on what vendors have ...


1

It is extremely likely to be either RSA with PSS padding or RSA with PKCS#1 v1.5 padding, the latter being the most likely. If you sign two times and the output is twice the same then it is not PSS and PKCS#1 v1.5 would be the prime suspect (that was my brain making fun of me, pun not intended). RSASSA-PSS is different from other RSA-based signature ...


1

All the arithmetic in SHA-256 should be 32-bit, it can be implemented at a low level using only 32-bit registers. If you use a representation that can go over 32 bits, then you need to truncate back to 32 bits on every calculation in your chosen language where it will not do so itself - i.e. on every addition.



Only top voted, non community-wiki answers of a minimum length are eligible