Linked Questions

I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and ...

I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of ...

What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else? And why do some researchers have a strong distrust of this model?

Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$. Why can't he perform the same ...

So I'm reading this question to learn more about length extension attack, and I want to make sure I understand the basics of padding. It says in the post that given the hash and the length of the ...

Is whirlpool vulnerable to length extension attacks? I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and ...

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...

I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...

I was told that a hash function (mostly looking at the SHA-* family) should have input strings of variant length provided first, and those of fixed length after (ie salt), in order to avoid some kind ...

Here is my situation. I'm working with an application for which uses hashing to authenticate data. I have a string, which is hashed. It is, like in a hash length extension attack, H(key:known_value) ...

I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know ...

I hope this question isn't too similar to one that's already been asked. I also want to point out I know part the answer already, AFAIK: I just want some expert input on this. Let's model a hash that ...