0
$\begingroup$

Suppose $H = \operatorname{SHA2-256}$.

Let $H_1 = H(\text{“Alpha1”})$.

Let $H_2 = H(\text{“Alpha2”})$.

Let $H_N = H(\text{“AlphaN”})$.

So all these digests are based off a common pre-image post-fixed with the index.

Question 1: Does knowing the values $H_1, \dotsc, H_N$ and the length of common pre-image substring "Alpha" leak any information about "Alpha"?

Question 2: Would double-hashing make any significant difference to pre-image security? E.g.: $H_i = H(H(\text{“Alpha”} \mathbin\| i))$

$\endgroup$
0
$\begingroup$

Question 1: Does knowing the values $H_1, \dotsc, H_N$ and the length of common pre-image substring "Alpha" leak any information about "Alpha"?

Only in the sense that it enables an adversary to test a guess for what the string might be. In particular, suppose the random variable $X$ has some probability distribution as far as you know. Knowing what $H(X \mathbin\| i)$ is narrows down the probability distribution on $X$ a great deal—possibly even to a unique value—and enables you to test a guess which you might not be able to do without knowing $H(X \mathbin\| i)$, but there's no way known to search for what $X$ might be cheaper than brute force.

Of course, if $X$ is simply (say) uniformly distributed among the English names for Greek letters—Alpha, Beta, Gamma, etc.—then the brute force search is already pretty cheap! Any security arises from a distribution with many more possibilities and much lower probabilities than $1/24$.

Question 2: Would double-hashing make any significant difference to pre-image security? E.g.: $H_i = H(H(\text{“Alpha”} \mathbin\| i))$

No; at most, it would slightly raise the false positive rate for a search.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ Suppose "Alpha" was really a 32byte secure cryptographic digest. Knowing it's 32bytes and knowing H_1..H_n, does it help me attack the pre-image? $\endgroup$ – Herman Schoenfeld Nov 13 '19 at 23:07
  • $\begingroup$ It doesn't matter what function you used to compute it; what matters is the entropy of the probability distribution on values that could be in the place where you put “Alpha”. You could choose the value to be a bit string of 256 fair coin tosses without any cryptographic digest involved, and an adversary would essentially never guess what they were. You could use the beefiest, expensivest password hash like Argon2 with a zillion iterations and gigabytes of memory and umpteen CPU cores to decide that value, and it wouldn't mean much if the input to Argon2 is determined by a single coin toss. $\endgroup$ – Squeamish Ossifrage Nov 13 '19 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.