# Tag Info

11

The functions used by SHA-2, called $Ch$ and $Maj$ are defined like this in the standard: $$Ch(x, y, z) = (x \land y) \oplus (\lnot x \land z)$$ $$Maj(x, y, z) = (x \land y) \oplus (x \land z) \oplus (y \land z)$$ However, an equivalent way to define them replaces the XOR with OR, as the standard (pdf) states: Each of the algorithms include $Ch(x, y, ... 8 I would use HMAC-SHA256. While poncho's answer that both are secure is reasonable, there are several reasons I would prefer to use SHA-256 as the hash: Attacks only get better. SHA-1 collision resistance is already broken, so it's not impossible that other attacks will also be possible in the future. It allows you to depend on just one hash function, ... 6 If we assume that the range of possible values of$n/k$is sufficiently large that it is infeasible for the attacker to scan through$\operatorname{SHA256}(ik)$values (and look for a match in one of the hashes), then it would appear to be secure. There is no known weakness in SHA256 about hashing related messages. 6 First, md5, Can I use md5 as a two way function if I can break the data in 64bit, will I be able to recover the original message without a pre-calculated a MD5 is a hash function, not a cipher. Differently stated: you will not be able to encrypt or decrypt anything by simply using a hash function. You could compare MD5 hashes with each other, but that ... 5 You can't say SHA-2 has a security level of half its hash length without any given context. 128 bit against what type of attack? What is the attacker trying to do? Perform a collision? Ok yes it has 128 bit against collisions. Perform a preimage? Nope it has 256 bit security against preimage attacks. Any algorithm is considered n bit strength if the ... 5 A quick look at the SHA-256 and SHA-512 implementations in Bouncy Castle do not show up any OR calculations, except to implement the rotation. The implementation of rotate (in Sum and Sigma) can however just as easily use XOR if required. Anyway, if it would be present: A or B = (A xor B) xor (A and B) - and it's gone again. 5 Like Richie Frame commented, as SHA-2 padding uses the length of the message that is not possible. Specifically, even if you had some string of input that took you from the SHA-512 IV to the SHA-512/256 IV, any message you hashed with it prepended would have a different length and thus a different hash value. Additionally, even ignoring the padding it would ... 4 The short answer is that no, the length of validity would not help in a major way. First you have to consider how the attack on the collision resistance of SHA-1 applies to certificates. The idea, and how it actually worked in the case of MD5, is basically: Attacker finds a collision in the hash function that generates two certificates with the same hash. ... 4 There is no known exploitable relationships between the words (32/64 bit "chunks") of SHA-2 but this is always a source of cryptanalysis. There are some academic weaknesses against reduced round variants of SHA-2 but nothing against the full cipher. Still hashes are cheap so why not just use multiple hash functions? Seed = HASH(secret) <- This should ... 4 The difference is: All SHA-0, 1 & 2 and MD5 come under a class of algorithm called Merkle–Damgård construction, while SHA-3 falls under Sponge functions. Merkle–Damgård construction is a method of building collision-resistant cryptographic hash functions from collision-resistant one-way compression functions. And, Sponge functions are a class of ... 3 In your case, the hash function should be correlated-input secure. Hash functions that meet this notion were considered in literature, e.g., https://eprint.iacr.org/2011/233. One caveat is that correlation under these constructions is defined relative to a specific class of inputs. The paper describes a simple example of a one-way function that is not ... 3 I'm not aware of any attacks on SHA-512 this way. I would create a small function to validate that the input size to SHA-512 is indeed identical to the seed size though, just in case. Even without that the function should be secure. Kind of related is my question about KDF1 and KDF2. Note that implementation of HKDF-expand from a hash should be pretty easy, ... 3 SipHash doesn't claim to be a secure hash function. Only a secure MAC. So if you try to use it as a hash function, with a constant, public key, you are on your own. SHA-512/64 should be a "secure" 64-bit hash, which is of course not enough for a truly secure hash, since it only has 32-bit collision resistance. However, since you only desire preimage ... 2 In$\text{SHA-512}$the size of the blocks is 1024 bit. The last block must contain: the rest of data in message (mod 1024). some filling (padding) the last 128 bits as length If the message is 1919 bit length: Calculate the size of the data in the last block:$1919 \mod 1024 = 895$Add the size of length field(128 bit) to the last block size(895 ... 2 This could be susceptible to a rainbow table attack, especially if you can collect lots sequential ones. For example, if I have a rainbow table of hash(0), hash(1000000), hash(2000000).... which would be 1/1,000,000th of the size of the full rainbow table, then I could look up each value coming out of your sequence in my rainbow table. Once I know one, I ... 2 So your idea is to effectively turn the password authentication into a key-based authentication by deriving the machine passwords from a single random key stored elsewhere. Assuming key storage is secure (probably encrypted with a strong password), this is sound. It would be better to just use the asymmetric key-based authentication built into most remote ... 2 I'm led to believe the use of SHA-1 for the ECDHE parameters is not due to misconfiguration, but is rather the intended (albeit not ideal) behaviour of server-side Schannel. This behavior seems to be present in versions up to Windows Server 2012 R2 and even continues with Windows Server 2016 Technical Preview 5. I've captured handshakes with many, many ... 1 SHA-512 is a cryptographically secure hash, PBKDF2 is what we call a Password Based Key Derivation Function. If the resulting secret isn't used as key but as hash value it's also called a password hash. Password hashes differ from secure hashes in the sense that they contain a salt and a work factor / iteration count. Both are however one way functions ... 1 On the server, the certificate is stored in a certificate store, that includes a link to the private key. That link really is the name of a CSP (Cryptographic Service Provider) and the name of a container in that CSP. CSP relate to CryptoAPI, the old cryptographic API that is unfortunately hostile to hash functions other than MD5 and SHA-1. Chances are that ... 1 This is basically how KDF1 and KDF2 work: use a secret, add a (constant sized) label + possible other values such as a salt and then use this as input for a hash value. Another way to look at it is to view the seed + number as a new number and then reduce the problem to the problem that Richie Frame pointed at. So: yes it will behave randomly no, no ... 1 Security in the table refers to collision resistance. By the birthday problem, there's a generic attack that finds collisions in any compressing function by choosing$\sqrt{2^m}$random inputs ($m/2$security bits), where$m$is the output length. Depending on the application, weaker requirements might be sufficient, such as second pre-image resistance or ... 1$ Pr(H(a) \oplus H(b) = V)$is independent of$V$For a good hash, as pointed out in the comments. Pick your input space to be the output space of SHA-224 so with probability$1/2$(1) holds. The range of$H$is a group under$\oplus$. So (2) holds. 3 won't hold by the same group property. Another$2^{112}$trials will likely yield$a',b'$satisfying (3) ... 1 While Switch is right about the difference between Merkle–Damgård and Sponge constructions, I don't believe he is correct as to NIST's reasoning. I happened to talk to a NIST cryptographer (John Kelsey) about this. He indicated that they selected Keccak not because they distrust the SHA-2 design (Merkle–Damgård is provably secure if the compression ... 1 You need to prove that there does not exist a way of finding$x$and$y$so that$plaintext \oplus x$and$H(plaintext) \oplus y = H(plaintext \oplus x)\$. The problem is that the attacker is unlimited in time, so the above may actually be possible. (It suffices to prove that there exist messages for which this can be done.) In addition, in order for this to ...

1

Your setup is secure. However it is largely "unneccessarily" secure. First the generation method: You're using the RNG-CSP which is (I guess) Microsoft's software interface to the Windows secure PRNG, so this is fine. Now for your tokens: You're restricting the character set, which reduces the possible entropy per byte, but is fine if you're in a ...

1

A quick resarch showed that there are no (good) attacks on Siphash. For SHA-512 there are defintely no known attacks. The first 64 bits of SHA-512 should have the same security guarantees as full SHA-512 has. So breaking any of the two comes down to how fast they are. SHA-512 is slower, in particular it achieves 192.5 cycles / byte in a 64-bit C ...

Only top voted, non community-wiki answers of a minimum length are eligible