# Tag Info

16

As a general rule, you should avoid SHA1 for new applications and instead go with one of the hash functions from the SHA-2 family. As far as truncating a hash goes, that's fine. It's explicitly endorsed by the NIST, and there are hash functions in the SHA-2 family that are simple truncated variants of their full brethren: SHA-256/224, SHA-512/224, ...

15

No. The wikipedia article is in my honest opinion misrepresenting this article on a reduced round attack on the SHA-2 family of hashes. Although these attacks improve upon the existing reduced round SHA-2 attacks, they do not threaten the security of the full SHA-2 family. In other words, no collisions have been found in any of the SHA-2 hashes. The ...

11

No, theoretically a SHA1 hash can be any 160-bit value, including the string of 160 zeroes. As for your second question, if we fudge a little bit and consider SHA1 a truly random function this becomes the same question as the following: If we flip 160 coins, what is the probability that at least 128 of them will be heads? Solution is left as an exercise ...

10

The initial values to a Merkle–Damgård type hash function are essentially the plaintext to a block cipher, with the input to the hash function becoming the key. The maximum length of the hash is determined by the amount of bits of initial value. Five 32-bit words gives SHA1 a state size and maximum output of 160 bits. In order for an MD type hash function to ...

7

Well, SHA-1 and SHA-256 are both limited to inputs of no more than $2^{64}-1$ bits; the HMAC architecture itself prepends a logical IPAD (which is 512 bits); hence both HMAC-SHA160 and HMAC-SHA256 are both limited to inputs of no more than $2^{64} - 513$ bits, which is about 2 exabytes. I rather suspect that this is not a serious limitation to your ...

7

In early years of hash function design it was unclear how to choose constants (not only initial vectors), and it was widely assumed that the more random they look, the more secure the function is. There is still not much research in this direction. However, there have been several attacks (rotational cryptanalysis, slide attacks, internal difference attacks) ...

7

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? Yes. That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed. How much HMAC-SHA256 is slower than HMAC-SHA1? Those ...

6

There is no such proof, on the contrary it has been proven that SHA-1 does not possess the ideal 80 bit collision resistance. Rather it is down to around 61 bits of resistance, uncomfortably close to being practically exploitable, and even if no further weaknesses are found advances in computing power are almost guaranteed to make it reasonably practical ...

6

If the question is 'why are those variables initialized at all', well, that's because those values will be used as inputs to the initial SHA-1 compression function; they must be consistent values; otherwise, the resulting hash will be different (depending on what values were used). If the question is 'why are those specific values used (rather than other ...

5

Because the RFC says so. Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2]. It says the same for RSA half a page down. Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated ...

5

Base64 provides a 1:1 transform from input to output (and back again if desired). So if you take a set of unique items and base64 encode all of them they will all be unique. So the question becomes if you run a GUID through SHA1, will the resulting hash have the same uniqueness as the GUID? The answer is practically - yes; theoretically not quite. Multiple ...

4

Great question, I'd love to see more proofs as well. This is pretty cool: https://class.coursera.org/crypto-preview/lecture/29 This is a very easy to follow and interesting proof based on the Merkle-Damgard construction (used for SHA1) that if you have a collision resistance function for a short message -> you have a collision resistance function for long ...

4

It's probably a really bad idea to try and roll-your-own here. If you have to ask a question like this, you would probably just be better off using shrink-wrapped solution like SSL rather than trying to make your own protocol. There are a lot of tricky problems around getting these kinds of things right. However, if you insist on doing this yourself, there ...

3

Given message $A$, you have to find message $B$, such that the first 64 bits (say, MSB) of their hashes collide: $$MSB_{64}(H(A)) = MSB_{64}(H(B))$$ This problem is called Second Preimage Search for the function $MSB_{64}(H)$, or Partial Second Preimage Search for the hash function $H$ alone. When $H$ is the full round SHA-1, there is no result, ...

3

Decoding AES256-CTS-HMAC-SHA1-96 AES256 = AES using 256-bit key CTS = ciphertext stealing HMAC-SHA1-96 = HMAC using SHA-1 hash function with mac truncated to 96 bits. The benefits of HMAC truncation are discussed in FIPS PUB 198-1, chapter 5. For HMAC-SHA1 96 bits is very common truncation, used for instance by IPsec/ESP. For figuring out what key ...

3

Password hashes need first pre-image resistance and should not cause many collisions among typical passwords (preserve the entropy). This collision "attack" violates neither requirement and causes no practical security issues. While this issue can find trivial collisions, they're not between commonly chosen passwords. A SHA-1 hash (and thus the shorter of ...

3

You're somewhat on the right track. A standard way to do this would be using an RSA sign/verify scheme. On the server, user-specific and license-specific data is concatenated into a string and signed with the private key. In the software, the signature is verified with the public key. The public key can not be used to create valid signatures, it can only ...

3

The birthday problem is the generic name for such questions. You have $n$ values, selected randomly and uniformly in a space of size $t$; the probability that at least two of these values are identical is roughly equal to $n^2/(2t)$. When $n$ becomes close to $\sqrt{t}$, then the probability raises sharply. In your case, with 5 hexadecimal digits, you have a ...

3

SHA-1, SHA-224 and SHA-256 append the bit “1” to the end of the message, followed by k zero bits, where k is the smallest, non-negative solution to the equation l+1+k ≡ 448 mod 512, where l - message length. In second step they use 32-bit words. SHA-384, SHA-512, SHA-512/224 and SHA-512/256 use different equation: l+1+k ≡ 896 mod 1024 and in 2. step ...

2

Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? A good (secure) hash function has output that is uniformly and evenly distributed and shouldn't be distinguishable from random value. Chi-squared tests of several hash functions So the minimum number of possible ones is $0$ and the maximum ...

2

No, it is not broken. This is NOT A PROBLEM for PBKDF2-HMAC-SHA1. The PBKDF2-HMAC-SHA1 function is a key derivation function (password-based key derivation). It is fairly good function, for instance it is recommended by NIST (NIST SP 800-132). It is (relatively) rare for this function to have a collision, but collisions generally are not a problem for key ...

2

To answer your main question. Yes, NULL ciphersuites do provide authenticity and integrity checks but not confidentiality for the TLS traffic. There is still a specified key exchange algorithm (e.g. RSA) for the TLS handshake protocol. The client will generate a pre-master secret and encrypt it with the server's public key for server authentication. The ...

2

There is no why it is identical. The input form of the data does not influence what the output of a secure hash function should look like. The output of a hash should be unrelated to the output except for the mapping performed in the hash function itself. There should be no method of calculating the output other than to execute the hash function. The best ...

1

There are multiple ways to do this, but I recommend neither of the solution proposals in the question. Instead you can, for instance, Use SHA-1 with PBKDF2, use KBKDF after PBKDF2, use authenticated en/decryption after PBKDF2, request longer output from PBKDF2. Depending on your needs, any one of these could be the solution for you. For details, read on. ...

1

It would help to understand the context a little. I'm assuming you're trying to arrive at a password-based key and you're trying to maximize the brute-force time required to guess the key. But maybe this data will be used as a tag, or you're interested in maximizing the time to create a password-key dictionary or something. I would consider the search ...

1

Your scheme doesn't appear to provide any authentication whatsoever. For a normal RSA digital signature the intended recipient can calculate the hash of the message, decrypt the signature using the public key to get the original hash, and compare them to authenticate the message. If an attacker is to tamper with the message, then in order to change the ...

1

Evaluating, we have that Sha_1(38607310235)=6502c8f9f5c222b9598d4e074fd3431f506948bc So, I'm guessing the question you're actually asking is: Given an 11 digit number $x$, find $y$ such that $L[H(y)]=x$, where $L(\cdot)$ takes the last 11 hexadecimal characters, and $H(\cdot)$ is the SHA-1 hash function This problem is believed to be hard to do, so ...

1

Without reading through your protocol, yes there is a method of generating two hashes from a single message: just include a counter or any other additional information. So H = Hash(C1 | M) and H' = Hash(C2 | M) would mean H != H' if C1 != C2. C1 and C2 can be public, but brute force attacks would of course apply. You can find M using H or H' if M can be ...

1

I'd need to know precisely what the "lookup" operation does but I'm pretty worried already by that XOR. Let's remove the lookup operation for now and see what happens. Suppose we have two hashes that hash to the same length ($L$) and we XOR their outputs. You've now got a much weaker hash that either of them. Here's how to find a collision. Hash a message ...

1

A theoretical attack is an attack strategy that was born out of “theory”, “calculation”, and — in the least cases — “simulation”. Yet, the strategy is yet to be proven in practice. An actual attack which is practically proven and can be replicated is actual proof that a theoretical attack works. Therefore, the first is an indication of a weakness, while an ...

Only top voted, non community-wiki answers of a minimum length are eligible