# Tag Info

7

In computer science, and implementation of crypto, ROTL stands for ROTate Left. ROTL is also noted ROL, or RLNC for Rotate Left No Carry. On a $w$-bit word with bits numbered from $0$, bit number $j$ of the input of ROTL with a shift count of $n$ goes to bit $j+n\bmod w$ of the result; $n=1$ unless otherwise specified (and is the only value available on ...

1

Using AES as a Davies Meyer compression function is a bad idea: It has a block size of 128 bits, which limits its collision resistance to 64 bits, which is rather weak. This limitation could be overcome by using Rijndael with a 256 bit block size, but then you'd need to use a higher number of rounds. AES has been designed to work with randomly chosen ...

0

I looked more into it and saw that the state input is the data input of the block cipher and the data (that is being hashed) is the key input to the underlying block cipher (SHACAL). Thanks anyway.

0

Usually Hashes are not used by themselves for integrity for exactly the reason you state. To make them stronger we take the hash and encrypt it using the private key of the sender. This way anybody who has the sender's public key can decrypt the hash and check it against a new hash of the message, but a man-in-the-middle can not fake it since they do not ...

2

There is none. Conjunctive normal form is for Boolean formulas, which have a single truth value. SHA-256 is not a Boolean formula (SHA-256(x) is not "true" or "false.") Furthermore, CNF is only applicable if you have a fixed number of variables; this is not true for SHA-256, which has variable-length input. At best you could have 256 different formulas, each ...

0

With regards to the algorithm, HMAC-SHA256 is considered very secure. As with most symmetric algorithms it can probably not be proven secure, but that should not worry you overmuch. The most important security consideration with HMAC is to use a time consistent compare when verifying the authentication tag. A 256 bit key could be considered for the simple ...

4

Indeed hashing is used to ensure integrity, but not this way. What you have in mind it seems is sending (msg, Hash(msg)). Indeed this is not secure because of the attack you describe. The first step starts with something you say by yourself: hashing algorithms are universal algorithms The name is not univesal but public, it means anyone knows it. ...

5

Introduction BCrypt is a password-based KDF (far from state-of-the-art, but better than PBKDF2, because BCrypt requires sizable RAM, which greatly increases the cost of hardware-accelerated password search). Bcrypt is based on the blockcipher Blowfish, with the initial processing of the password reminiscent of Blowfish's key preprocessing. Bruce Schneier's ...

1

Hashing a password does not necessarily weakens the password. What is more important in this case is the collision resistance of the hash algorithm. As long as the collision resistance is given a hash values used is enough to get a high security.

1

I would feel perfectly safe with a 72 byte password. Computing a shorter hash of a longer password is not necessarily weakening your scheme. Passwords are typically not truly random and contain only human readable characters, so that for instance a password of 60 bytes may have an entropy of only 32 bytes. See https://en.wikipedia.org/wiki/Password_strength ...

0

The wikipedia page for the Birthday problem gives the details, including the exact formula. As an approximation you can use: $$p \approx 1-\exp(-\frac{\tfrac{1}{2}n(n-1)}{2^{256}}) \approx 1-\exp\left(-\frac{n^2}{2 \cdot 2^{256}}\right) \approx 1-\exp\left(-\tfrac{1}{2} \left(\frac{n}{2^{128}}\right)^2\right)$$ If $n \ll 2^{256/2}$ and thus $p \ll 1$ you ...

Top 50 recent answers are included