Linked Questions
35 questions linked to/from What are the odds of collisions for a hash function with 256-bit output?
40
votes
2
answers
13k
views
How does hashing twice protect against birthday attacks?
The bitcoin wiki says:
Bitcoin is using two hash iterations (denoted SHA256^2 ie "SHA256 function squared") and the reason for this relates to a partial attack on the smaller but related SHA1 hash. ...
- 503
22
votes
1
answer
20k
views
Are there any well-known examples of SHA-256 collisions?
The popularity of SHA-256 as a hashing algorithm, along with the fact that it has 2256 buckets to choose from leads me to believe that collisions do exist but are quite rare.
Are there any well-...
- 333
19
votes
5
answers
3k
views
How many hex digits do I need to compare when manually checking hash functions?
I sometimes run sha256sum on large files after transferring them from one place to another, and will just skim the hash output to verify it's correct. But, I usually just look at the first/last 5 or 6 ...
- 193
9
votes
2
answers
819
views
Is there a guarantee that for each possible hash y there exists a number x such that with hash function H, H(x) = y?
Specifically talking about SHA-256 here and its involvement in Bitcoin, this was a question someone asked me which I didn't know the answer to. Yes, I am aware that SHA-256 can only have a hash from $...
- 93
6
votes
2
answers
22k
views
Computational requirements for breaking SHA-256?
Let's define "breaking" a hash function $H$ as being threefold (corresponding to the main properties of a cryptographic hash function):
preimage attacks to get $m$ knowing $H(m)$
second-preimage ...
- 740
5
votes
2
answers
9k
views
Are SHA-256 and SHA-512 collision resistant?
Context: Designing a TinyUrl system. The user inputs a lengthy URL and the system computes the hash and encodes it binary64 and sends it back to the user.
From what I understood so far (from this ...
- 153
4
votes
2
answers
2k
views
Are My Answers to This Hash Question Correct?
Question
When determining the security of a hash system, the cryptanalyst tries the following attacks.
(a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
- 43
4
votes
1
answer
198
views
For a random permutation $P$, what's the probability of the following event?
For a random permutation $P$ and $q$ distinct inputs $x_1,\ldots,x_q\in\{0,1\}^n$, what's the probability of the event that there exists at least one collision among $\{P(x_1)\oplus x_1,\ldots,P(x_q)\...
- 41
3
votes
1
answer
578
views
Is Paillier secure from known plaintext attack for single character message?
Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3.
Does that mean that c1=c2=c3 in cipher-text from ?
If not, how many times can I encrypt a message m=1 and still ...
- 65
3
votes
4
answers
3k
views
What is the best algorithm for compressing a hash?
What is the best way to transform a hash with a longer length into one with a smaller length, preventing as many collisions as possible? (Hashing the hash)
For example: Some versions of Git use SHA-1 ...
- 143
3
votes
1
answer
161
views
Is it possible to sign in to a website using two different passwords using an MD5 hash collision?
I wanna do an experiment. I wanna see if it's possible to sign in to an outdated website that still uses MD5 to store passwords (there are surprisingly still a lot) with two different passwords.
For ...
- 31
3
votes
2
answers
487
views
How many different keys can be derived with HKDF before two outputs are identical?
How many different keys can be derived with HKDF before two outputs are identical?
This question is about collision resistance, not about generating different keys with different parameters (eg. ...
- 31
3
votes
1
answer
1k
views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
- 165
3
votes
1
answer
2k
views
Difficulty of collision vs preimage vs second-preimage attacks
It seems at first glance that brute-forcing a collision would be exactly as difficult for all of them. They all (I would expect) work like this: select a hash value, and then try messages to get an ...
- 2,005
3
votes
1
answer
820
views
Birthday attack for combination of hashes
I have to answer the following question for a homework assignment:
You have a hash algorithm that converts a $2\cdot n$ bit number to an n bit
number. How many hash values do you have to ...
- 143