Linked Questions

3
votes
3answers
2k views

Any weakness when performing SHA-256 repeatedly? [duplicate]

Is it significantly easier to reverse a SHA-256 hash if you know that the input was a 32 byte output of SHA-256? I assume for most outputs of SHA-256 there will be zero, one or two possible 32 byte ...
76
votes
2answers
18k views

What is the “Random Oracle Model” and why is it controversial?

What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else? And why do some researchers have a strong distrust of this model?
25
votes
1answer
7k views

Why hashing twice?

I'm trying to understand the Bitcoin protocol, and sometimes see instructions like this: The TransactionId is defined by SHA256(SHA256(txbytes)) or The hash of the public key is generated by ...
15
votes
3answers
5k views

At the current time, is SHA256 the de facto standard for strong cryptographic hashes?

At the current time, is SHA256 the de facto standard for strong cryptographic hashes? From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
10
votes
1answer
1k views

Why does HMAC use two different keys?

Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
9
votes
1answer
2k views

How to to calculate the hash of an unordered set

Suppose I have a set of elements, with known hash (e.g. SHA-2). How can I calculate the hash of the set? With it I mean an unordered set, so the order of elements is undefined and shall not play any ...
6
votes
1answer
523 views

Can iterated hashing be used to mitigate collision and preimage weaknesses?

How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two? For example, can MD5 be fixed (in practice) by ...
1
vote
2answers
907 views

Does the double-hash H(H(x)) have greater collision probability than H(x)?

Let $H$ be a collision resistant hash function and $P_c[H](S)$ the collision probability about a sample set $S$ of input elements (eg. random numbers). It increases with double hash? That is, $P_c[H\...
3
votes
2answers
497 views

Would SHA-256(SHA-256(x)) produce collisions?

Was reviewing some Bitcoin public-key hash literature and the use of RIPEMD-160 and the SHA-256 as below: RIPEMD160(SHA256(ECDSA_publicKey)) The Proof-of-work ...
4
votes
1answer
394 views

Can chaining hash functions reduce security?

Is there a concrete case where chaining cryptographic hash functions reduces security? I'm thinking of things like md5(md5(x)) or ...
0
votes
1answer
133 views

Whether hash function of two values $h(a,b)=h(b,a)$ are same?

If two messages $M_1$ and $M_2$ are given as input to a hash function $h$ is it then true that $h(M_1,M_2) = h(M_2,M_1)$? I have two messages. I want to know, Is it possible to apply a hash ...
4
votes
1answer
132 views

Why does FS&K's SHAd-256 construction zero-prefix the inner message?

Ferguson, Schneier and Kohno's Cryptography Engineering §5.4.2 describes a construction, $\operatorname{SHA}_d\text-X(m)$, which is just $\operatorname{SHA-\!}X(\operatorname{SHA-\!}X(0^b\mathbin\|m))$...
1
vote
1answer
135 views

are there more efficient methods than HMAC to achieve convergent encryption?

I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...