# Tag Info

14

No. The wikipedia article is in my honest opinion misrepresenting this article on a reduced round attack on the SHA-2 family of hashes. Although these attacks improve upon the existing reduced round SHA-2 attacks, they do not threaten the security of the full SHA-2 family. In other words, no collisions have been found in any of the SHA-2 hashes. The ...

14

As a general rule, you should avoid SHA1 for new applications and instead go with one of the hash functions from the SHA-2 family. As far as truncating a hash goes, that's fine. It's explicitly endorsed by the NIST, and there are hash functions in the SHA-2 family that are simple truncated variants of their full brethren: SHA-256/224, SHA-512/224, ...

11

No, theoretically a SHA1 hash can be any 160-bit value, including the string of 160 zeroes. As for your second question, if we fudge a little bit and consider SHA1 a truly random function this becomes the same question as the following: If we flip 160 coins, what is the probability that at least 128 of them will be heads? Solution is left as an exercise ...

10

I would recommend phasing out SHA-1 in any scenario where collision-resistance of a hash is required, for there is a wide consensus that an attack with $2^{69}$ complexity would work, it would already be feasible by a resourceful entity, and attacks only get better. I'm still confident that SHA-1 is preimage and second-preimage resistant for all practical ...

10

The initial values to a Merkle–Damgård type hash function are essentially the plaintext to a block cipher, with the input to the hash function becoming the key. The maximum length of the hash is determined by the amount of bits of initial value. Five 32-bit words gives SHA1 a state size and maximum output of 160 bits. In order for an MD type hash function to ...

7

In early years of hash function design it was unclear how to choose constants (not only initial vectors), and it was widely assumed that the more random they look, the more secure the function is. There is still not much research in this direction. However, there have been several attacks (rotational cryptanalysis, slide attacks, internal difference attacks) ...

7

Well, SHA-1 and SHA-256 are both limited to inputs of no more than $2^{64}-1$ bits; the HMAC architecture itself prepends a logical IPAD (which is 512 bits); hence both HMAC-SHA160 and HMAC-SHA256 are both limited to inputs of no more than $2^{64} - 513$ bits, which is about 2 exabytes. I rather suspect that this is not a serious limitation to your ...

6

There is no such proof, on the contrary it has been proven that SHA-1 does not possess the ideal 80 bit collision resistance. Rather it is down to around 61 bits of resistance, uncomfortably close to being practically exploitable, and even if no further weaknesses are found advances in computing power are almost guaranteed to make it reasonably practical ...

6

If the question is 'why are those variables initialized at all', well, that's because those values will be used as inputs to the initial SHA-1 compression function; they must be consistent values; otherwise, the resulting hash will be different (depending on what values were used). If the question is 'why are those specific values used (rather than other ...

5

Base64 provides a 1:1 transform from input to output (and back again if desired). So if you take a set of unique items and base64 encode all of them they will all be unique. So the question becomes if you run a GUID through SHA1, will the resulting hash have the same uniqueness as the GUID? The answer is practically - yes; theoretically not quite. Multiple ...

4

Great question, I'd love to see more proofs as well. This is pretty cool: https://class.coursera.org/crypto-preview/lecture/29 This is a very easy to follow and interesting proof based on the Merkle-Damgard construction (used for SHA1) that if you have a collision resistance function for a short message -> you have a collision resistance function for long ...

3

SHA-1, SHA-224 and SHA-256 append the bit “1” to the end of the message, followed by k zero bits, where k is the smallest, non-negative solution to the equation l+1+k ≡ 448 mod 512, where l - message length. In second step they use 32-bit words. SHA-384, SHA-512, SHA-512/224 and SHA-512/256 use different equation: l+1+k ≡ 896 mod 1024 and in 2. step ...

3

SHA-1 is only academically broken. So, it is still secure for all uses. The problem is, attacks only get better. So, migrating to SHA-2 (or at least planning for a SHA-2 migration) would be a good move. That said, of interesting note is that even if SHA-1 were practically broken it might still be okay for use in HMAC.

3

It's probably a really bad idea to try and roll-your-own here. If you have to ask a question like this, you would probably just be better off using shrink-wrapped solution like SSL rather than trying to make your own protocol. There are a lot of tricky problems around getting these kinds of things right. However, if you insist on doing this yourself, there ...

3

You're somewhat on the right track. A standard way to do this would be using an RSA sign/verify scheme. On the server, user-specific and license-specific data is concatenated into a string and signed with the private key. In the software, the signature is verified with the public key. The public key can not be used to create valid signatures, it can only ...

3

The birthday problem is the generic name for such questions. You have $n$ values, selected randomly and uniformly in a space of size $t$; the probability that at least two of these values are identical is roughly equal to $n^2/(2t)$. When $n$ becomes close to $\sqrt{t}$, then the probability raises sharply. In your case, with 5 hexadecimal digits, you have a ...

2

Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? A good (secure) hash function has output that is uniformly and evenly distributed and shouldn't be distinguishable from random value. Chi-squared tests of several hash functions So the minimum number of possible ones is $0$ and the maximum ...

2

No, it's not possible. RSA based signatures can only be generated if you know the private key. At the RSA primitive level, signing is the same as decrypting a message (where the data being decrypted in this instance is a hash of the message). If you change the hash, then verification of that signature would fail. Without knowledge of the corresponding ...

2

Decoding AES256-CTS-HMAC-SHA1-96 AES256 = AES using 256-bit key CTS = ciphertext stealing HMAC-SHA1-96 = HMAC using SHA-1 hash function with mac truncated to 96 bits. The benefits of HMAC truncation are discussed in FIPS PUB 198-1, chapter 5. For HMAC-SHA1 96 bits is very common truncation, used for instance by IPsec/ESP. For figuring out what key ...

2

There is no why it is identical. The input form of the data does not influence what the output of a secure hash function should look like. The output of a hash should be unrelated to the output except for the mapping performed in the hash function itself. There should be no method of calculating the output other than to execute the hash function. The best ...

1

Evaluating, we have that Sha_1(38607310235)=6502c8f9f5c222b9598d4e074fd3431f506948bc So, I'm guessing the question you're actually asking is: Given an 11 digit number $x$, find $y$ such that $L[H(y)]=x$, where $L(\cdot)$ takes the last 11 hexadecimal characters, and $H(\cdot)$ is the SHA-1 hash function This problem is believed to be hard to do, so ...

1

Without reading through your protocol, yes there is a method of generating two hashes from a single message: just include a counter or any other additional information. So H = Hash(C1 | M) and H' = Hash(C2 | M) would mean H != H' if C1 != C2. C1 and C2 can be public, but brute force attacks would of course apply. You can find M using H or H' if M can be ...

1

I'd need to know precisely what the "lookup" operation does but I'm pretty worried already by that XOR. Let's remove the lookup operation for now and see what happens. Suppose we have two hashes that hash to the same length ($L$) and we XOR their outputs. You've now got a much weaker hash that either of them. Here's how to find a collision. Hash a message ...

1

A theoretical attack is an attack strategy that was born out of “theory”, “calculation”, and — in the least cases — “simulation”. Yet, the strategy is yet to be proven in practice. An actual attack which is practically proven and can be replicated is actual proof that a theoretical attack works. Therefore, the first is an indication of a weakness, while an ...

1

You are looking at the SHA-1 specification, not the SHA-256 one. You are quoting pages 15,16 in the PDF you linked to. The remarks Thomas made also apply to SHA-256 though: the message block of 16 32-bit words is expanded to an auxiliary array of 64 (because we have 64 rounds, and we use one of the $W[t]$ in each round) 32-bit words. Then page 19 has the ...

1

What this does is expand the 16-word (512-bit) input message block (to the compression function, i.e. one "chunk" of the complete message) into an 64-word array W[t]. The definition of this array is recursive. What it tells you is that the first 16 words of this 64-word array are just the words of the input chunk: W[t] = M[t] for 0 <= t <= 15 In ...

Only top voted, non community-wiki answers of a minimum length are eligible