0
$\begingroup$

I read this in the documentation of HighwayHash:

By contrast, 'strong' hashes such as SipHash or HighwayHash require infeasible attacker effort to find a hash collision (an expected 2^32 guesses of m per the birthday paradox) or recover the seed (2^63 requests). These security claims assume the seed is secret. It is reasonable to suppose s is initially unknown to attackers, e.g. generated on startup or even per-connection. A timing attack by Wool/Bar-Yosef recovers 13-bit seeds by testing all 8K possibilities using millions of requests, which takes several days (even assuming unrealistic 150 us round-trip times). It appears infeasible to recover 64-bit seeds in this way.

/\ This is talking about 64-bits output.

Let's suppose I take a 256-bits seed full of entropy from Linux /dev/hwrng and hash with a (cryptographic) hash function.

Based on that said above, can the adversary brute-force the seed space and find a collision with 2^128 guesses (128-bits)? Or will it have to brute-force the entire seed space to find the matching key (256-bits)?

This question could sound obvious, but the documentation of HighwayHash made me confused.

Improve this question
$\endgroup$
7
  • 1
    $\begingroup$ Hiya! But what is /dev/hwrng ? The NSA don't like that kinda stuff. $\endgroup$
    – Paul Uszak
    Mar 22 at 9:29
  • 2
    $\begingroup$ I answered but I deleted my answer. SipHash is a keyed hash and is used to prevent very specific attacks against hash tables. I'm not entirely sure that you are trying to use it in a way for which it is designed. As I'm unaware of the context I think my answer is void of meaning. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Mar 22 at 10:17
  • $\begingroup$ @PaulUszak I have been reading about conspiracies about the TRNG of Inter processors be backdoored, but I use AMD. I cited /dev/hwrng as an example, here I use CPU jittering as my main entropy source for avoiding any possibility of my hardware has the NSA hands. haha! I'm realy paranoid. $\endgroup$
    – alpominth
    Mar 22 at 20:33
  • 1
    $\begingroup$ @MaartenBodewes That was an example, there are variants of HighwayHash that outputs 128 and 256-bits respectively. $\endgroup$
    – alpominth
    Mar 24 at 0:40
  • 2
    $\begingroup$ @PaulUszak It is a reference to RDRAND in Intel and AMD processors (and probably similar instructions on ARM processors). So it might well be that NSA does like that stuff, according to your own reasoning. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Mar 24 at 8:33

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.