1
$\begingroup$

I am thinking about to concatenate two hashes, but I was searched about this and I have questions, if some one should help me. Thank you

I have two strings str1 and str2 with variable large. I need obtain a hash of these, but when I was searched I read about problems with collisions and I don't understand that.

In this moment I think that this is sufficient.

cipher = hash(str1) || hash(str2)

But according to other opinions is necessary add other injective function to prevent resistance collisions. That approach looks like this:

cipher = hash(hash(str1) || hash(str2))

What do you think?

EDIT

I use murmur3 with 128.

I have many data and I need to represent this whit hashes, because that I use hash function.

With the time I use the first approach but many collisions have appeared and I don't understand why. I think because I use murmur3 of 128 to everything data or I don't know.

Improve this question
$\endgroup$
5
  • $\begingroup$ I would use SHA384 with the 2nd approach. if I am not mistaken, murmur3 is maybe about as collision resistant as md5, and substantially less so if you want to introduce an intentional collision, it is not a cryptographic hash $\endgroup$
    – Richie Frame
    Jun 15, 2018 at 23:37
  • $\begingroup$ Sorry, but what type is this? $\endgroup$
    – fabulias
    Jun 16, 2018 at 9:27
  • $\begingroup$ murmur3 is designed to simply verify that one piece of data is different from another within a specific probability, without the constraint that someone might attack the scheme in which it is used. It is good for hash tables, think of it more like a 128-bit checksum $\endgroup$
    – Richie Frame
    Jun 17, 2018 at 0:35
  • $\begingroup$ also, the probability of collision is higher with a smaller hash function, which is why I suggested SHA384, which is more than a trillion trillion trillion times less likely to have a collision compared to murmur3 $\endgroup$
    – Richie Frame
    Jun 17, 2018 at 0:38
  • $\begingroup$ MD5 has a $2^{18}$ complexity two-block collision attack. Murmur hash is not even designed to be collision resistant. It's probably closer to that of MD4 in terms of collision resistance. $\endgroup$
    – forest ♦
    Jun 17, 2018 at 2:50

1 Answer 1

Reset to default
1
$\begingroup$

It is unclear what you are aiming for? If you are trying to get a hash function collision resistent even in the face of a malicious adversary? murmur is no good regardless of concatenations. You need to use a cryptographiclly secure hash such as something from the SHA-2 or SHA-3 families.

If you are talking about a non adverserial setup, murmur may suffice. But since modern cryptographic hashes have so fast implementations I usually recommend them anyway and have better piece of mind.

Regardless, both murur and the SHA families are defined on arbitraty length input so you can apply directly on concatenated input.

If you already have hashes, their concatenation(at double the output size) is at least as collision resistant as the underlying hash. The second construction at half the size also seems secure when a secure hash is used.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I'm using murmur3 because it was the most speed than others, I only hash the data to represent this, but with the time many collisions have appeared, so there my problem was born. Because I ask about the performance with hash the concatenation or not. $\endgroup$
    – fabulias
    Jun 16, 2018 at 16:03
  • 1
    $\begingroup$ I would be surprised to see many collisions in murmur 128 in naturally occurring data. There would have to be something really special about the way it is generated. That said have you benchmarked efficient implementations of For example SHA2-256 to see if they may be fast enough? They aren't as fast murmur but they are fast and essentially collision free. $\endgroup$
    – Meir Maor
    Jun 16, 2018 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.