2
$\begingroup$

What is blinding with a SHA256() or similar cryptographic hash function?

What applications does it have?

An answer to a recent question briefly mentioned "Consider blinding before calling an external function [such as] SHA256()". ( https://security.stackexchange.com/questions/246209/is-it-safe-to-publish-the-password-hashes-from-my-sha256-md5-custom-password-h/246275#246275 )

The Wikipedia article "blinding (cryptography)" currently mentions several different types of blinding, including asymmetric encryption, asymmetric digital signatures, and the one-time pad (a kind of symmetric encryption), but never mentions hash functions. Most applications in that article involved tweaking the plaintext slightly, then running the tweaked plaintext through some (untrusted) function to get some intermediate output, then untweaking to get the final output, in such a way that we get the same final output without the tweaking and untweaking, but without handing over plaintext to the (untrusted) function. Does SHA256() support such tweaking and untweaking? Whether or not it does, what is the proper approach to blinding with SHA256() or other cryptographic hash functions?

Improve this question
$\endgroup$
4
  • $\begingroup$ The wikipedia article mentions "asymmetric encryption schemes" - not symmetric ones. Among the symmetric ciphers, for stream ciphers blinding would work, for block ciphers it would not. In general - such a blinding can also be considered a security weakness. For example, I think blind signatures can not achieve EUF-CMA security - the blinding contradicts the security definition. $\endgroup$
    – tylo
    Mar 30, 2021 at 21:01
  • $\begingroup$ @tylo: If you suggesting the Wikipedia article "blinding (cryptography)" should say a few more words about stream and block ciphers and EUF-CMA, I agree. If you are suggesting an edit to this question, I honestly don't understand -- what change are you suggesting? $\endgroup$
    – David Cary
    Apr 4, 2021 at 13:42
  • $\begingroup$ From your question: "The Wikipedia article "blinding (cryptography)" currently mentions several different types of blinding, including symmetric encryption and asymmetric digital signatures" and that is wrong. Wikipedia says asymmetric encryption. $\endgroup$
    – tylo
    Apr 4, 2021 at 14:24
  • $\begingroup$ @tylo: I've tweaked the wording of the question -- does it look better now? $\endgroup$
    – David Cary
    Apr 17, 2021 at 5:54

2 Answers 2

Reset to default
1
$\begingroup$

There are at least three possible senses of blinding in crypto in a context involving a hash such as SHA-256. In all cases, the purpose is to hide something (the value, or the true meaning) of some data element manipulated.

  1. Blinding with the hash as a tool used as a black box. The exact meaning depends on the purpose. That can further subdivides into

    • we only to need to compare data elements for equality, so we can hash them, then compare the hashes
    • we use the hash output combined (e.g. by XOR) with a data element to mask.

  2. Blinding within the implementation of SHA-256, to thwart attacks trying to find the input of the hash from some side channel, like electromagnetic emission.

  3. Blinding the input of the hash. This is the sense in the linked text

Consider blinding before calling an external function.
You're passing your password into the MD5() and SHA256() functions plain-text-style. If either is backdoor'd, then they get your password. Consider blinding.

Here the goal seems to be hiding the password from an attacker having hooked the MD5() or SHA256() APIs (that could also be: able to invert these functions with a rainbow table). I think the author is suggesting transforming the password before hashing. That could be XOR-ing it with a secret constant, or applying some rudimentary cipher with a fixed key. This is not crypto, but an attempt to make code harder to reverse-engineer, or attacks more specific, using security by obscurity.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ If you're using a homomorphic hash, there's a fourth. Instead of hashing the secret $s$, you hash $s+r$ and $-r$, from which you can compute the hash of $(s)$. But I can't imagine any practical use case. $\endgroup$
    – Aman Grewal
    Mar 30, 2021 at 13:31
0
$\begingroup$

My answer in infosec stackexchange was deleted but it was migrated here anyway. Well,I have not heard if such tweaking is possible. See, hash functions are designed to emulate a random oracle as much as possible. Of course, random oracles cannot truly exist. In any random oracle, output of a "tweaked" input is totally independent of that of original input, so we cannot perform reversing tweaking on output to get output from original message. While sha256 does not emulate a random oracle in many known ways, see length extension attacks which would not be possible with a true random oracle, this particular property, as far as I know holds.

Others might have better answers here but I don't think it is possible if you are suggesting tweaking the input in some way, hashing it and "untweaking" it to get output of original message. If it was possible,it would not be considered secure.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.