Questions tagged [2nd-preimage-resistance]
Difficulty of finding another input string that hashes to the same value as a given string
70
questions
3
votes
0
answers
110
views
Sponge capacity feed-forward
Consider Sponge construction where capacity part of state is feed-forward and xor-ed into next state.
${state}_{i+1} = F({{state}_i}^{rate} || {{state}_i}^{capacity}) \oplus (0^{rate} || {{state}_i}^{...
- 1,649
1
vote
0
answers
196
views
Complete Binary Merkle Tree and second pre-image attack
To prevent second pre-image attacks, the Merkle Tree implementations I've looked
at add a 0 prefix to the leaves and a 1 prefix ...
- 11
0
votes
0
answers
130
views
Is this implementation of Merkle Trees susceptible to second preimage attack?
I am trying to find a good implementation of Merkle Tree generation in Golang, and I need the tree to be resilient to Second Preimage Attack
I have found this standard implementation in the golang ...
- 103
0
votes
0
answers
16
views
How to assign md5 of another file to one wav file? [duplicate]
Good afternoon . Please tell me how to change the md5 hash of one wav file to the md5 hash of another wav file. I want to bypass the anti-cheat check on md5. Maybe there are online paid services? I ...
- 1
2
votes
0
answers
125
views
Why this function isn't second preimage resistant?
Why is $h(k,m)$ not second-preimage resistant? Let $E_k$ be a block cipher where the message space is the same as the key space.
$$h(k,m)=E_k(m\oplus k)\oplus k$$
I've been reading about second ...
- 21
1
vote
1
answer
3k
views
Unhash possible? How got this user the unhash?
in this post Why can't we reverse hashes? there is an unhash of "Hello World".
How did that work? If there is no function to find it, where does it come from?
user97268
1
vote
0
answers
47
views
Finding second-preimage to this use of weak hash
$h'(x) := h(a_1 \parallel x \parallel b_1) \parallel h(a_2 \parallel x \parallel b_2) \parallel h(a_3 \parallel x \parallel b_3) \parallel \dots \parallel h(a_k \parallel x \parallel b_k)$
$a_i$ and $...
- 43
0
votes
1
answer
45
views
Finding multiple smaller collisions equal work as finding a bigger collision?
Problem A:
I receive two hash digests $H(x), H(y)$ and the corresponding preimages $(x, y)$.
$H$ is a 128-bit cryptographic hash function: $H: \{0,1\}^{*} \longrightarrow \{0, 1\}^{128}$
I need to ...
3
votes
2
answers
300
views
Application of cryptographic hash functions which do not require collision resistance property
I can not understand why collision resistance of a cryptographic hash function is not required for some applications. for example, if we store the trusted hash of a file or program, and later when we ...
- 43
4
votes
1
answer
493
views
What are the “costs” to find a pre-image, weak collision, or strong collision?
For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
- 43
1
vote
1
answer
182
views
Can we use a Merkle Tree structure to reduce digest size?
A 2nd preimage attack is possible on the standard Merkle tree as pictured below.
I'm aware that we can add identifiers (to differentiate nodes) to the input of each hash as discussed in the link. If ...
- 1,443
2
votes
1
answer
299
views
Practicality of a certain hash function
Consider the following hash function:
$$(V\cdot A + V\cdot B)^2 \bmod C$$
$A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
- 55
4
votes
1
answer
762
views
Why this isn't second preimage resistance?
I've been reading on preimage resistance and trying out few examples for the same and I'm trying to figure out why the following hash function does not have the second preimage resistance and any ...
- 321
1
vote
1
answer
245
views
finding second pseudo preimage faster than brute force
As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
- 165
2
votes
1
answer
271
views
Is an HMAC based on a second-preimage resistant hash function always unforgeable?
If hash function is collision-resistant, then its associated HMAC is always unforgeable. But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant. Then ...
3
votes
1
answer
515
views
Do hash functions for digital signatures need to be preimage resistant?
I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
- 159
4
votes
2
answers
1k
views
Are My Answers to This Hash Question Correct?
Question
When determining the security of a hash system, the cryptanalyst tries the following attacks.
(a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
- 43
3
votes
1
answer
51
views
How to find k-way second preimages
For example:
Assuming someone has found a second preimage for SHA-256. In other words, for SHA256(M1)=H, someone has found M2 which SHA256(M2)=H
Now, is it possible to generate k-way second ...
- 143
1
vote
0
answers
58
views
Why is this attack complexity equal that exact number of bit operations?
in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
- 55
6
votes
2
answers
4k
views
Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?
I found a hashcat benchmark results in the internet: hashcat results:
SHA-384 is 17065.4 MH/s
SHA-512 is 17280.3 MH/s
Why does SHA-512 take less time? SHA-512 is longer and I thought it therefore ...
- 197
1
vote
1
answer
224
views
Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?
I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case :
...
- 153
12
votes
3
answers
3k
views
SHA3-255, one bit less
I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
- 413
4
votes
0
answers
266
views
Second preimage attack complexity when the digest is malleable
An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. ...
- 15.1k
2
votes
1
answer
164
views
Cryptographic hash function based on logistic map?
Is there any secure cryptographic hash function based on the logistic map?
- 217
7
votes
2
answers
2k
views
Is there a feasible preimage attack for any hash function (no matter how deprecated) today?
Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?
All hashes that are nowadays considered 'broken' (...
- 1,397
2
votes
1
answer
867
views
Hashing based on the discrete logarithm problem
At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup).
Additionally, $H(x)$ ...
- 272
2
votes
2
answers
595
views
collisions on hash functions
Why do we say that collision-resistance is a "harder" property than second pre-image for hash functions whereas if you have an attack on the second pre-image then you find a collision ?
Moreover, a ...
- 217
3
votes
1
answer
150
views
Security implications of slow-by-design hashes on relative security vs. hash size
Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design?
Example: let's say you want 128-bit hashes. This is ...
- 896
4
votes
1
answer
1k
views
How can I determine if a hash function is secure?
I'm doing an exam in computer security and I encountered this problem which I'm unsure of how to attack properly. Should I get down and dirty with the Hash function on paper or is there a more general ...
- 141
1
vote
1
answer
360
views
Bitmasks or seed along with public key in WOTS+ post-quantum signatures
The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
- 232
2
votes
1
answer
589
views
Hash-based signature scheme XMSS/LMS susceptible to preimage/second preimage attack?
Are the quantum secure hash based signatures (XMSS/LMS) susceptible to preimage/second preimage attack?
- 2,257
3
votes
1
answer
940
views
Difference between second pre-image resistance attack and collision attack
According to my understanding of hashing algorithms -:
Collision attack is an attack wherein we have a hash(x) and we try to find hash(y) such that x!=y while hash(x)=hash(y).
Second pre-image ...
- 133
3
votes
1
answer
1k
views
Winternitz One time signature security
There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$
Security of both is as following
$W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...
- 575
6
votes
2
answers
21k
views
Computational requirements for breaking SHA-256?
Let's define "breaking" a hash function $H$ as being threefold (corresponding to the main properties of a cryptographic hash function):
preimage attacks to get $m$ knowing $H(m)$
second-preimage ...
- 740
-1
votes
1
answer
195
views
How many hash functions must Bob compute to find a solution?
Alice proposes the following puzzle to be completed.
Let m be the body of the email message,
let a be the recipient’s email address,
let H( )be the hash function SHA3-256, ...
- 11
3
votes
1
answer
1k
views
Difficulty of collision vs preimage vs second-preimage attacks
It seems at first glance that brute-forcing a collision would be exactly as difficult for all of them. They all (I would expect) work like this: select a hash value, and then try messages to get an ...
- 1,985
0
votes
1
answer
103
views
Second Preimages on n-bit Hash Functions by John Kelsey and Bruce Schneier
I read your https://www.schneier.com/academic/paperfiles/paper-preimages.pdf
And found there:
«3.2 A Generic Technique: Multicollisions of Different Lengths»
<...
- 11
5
votes
2
answers
257
views
usefulness of a collision attack that's not also a 2nd pre-image attack
So my understanding is that if we've got some hash function $H$ then a 2nd pre-image attack is one where given a message-hash pair $(m, H(m))$ we can find some $m' \neq m : H(m') = H(m)$, while a ...
- 153
4
votes
1
answer
1k
views
Why do different applications of hash functions demand different properties of the hash function?
A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
- 1,080
19
votes
2
answers
4k
views
Why is Pearson hash not used as a cryptographic hash?
The original algorithm produces 1 byte long hash and is (of course) not suitable for cryptography use.
But according to wikipedia, it is possible and easy to produce Pearson hash of any length, simply ...
- 293
1
vote
1
answer
682
views
Create a potential input for sha-256 hash given a substring of input?
Let's say I'm given a specific SHA-256 hash.
Further assume that the SHA-256 input, that yielded this hash contained a known sub-string.
Is there a way to find the input (containing the specific ...
- 13
2
votes
1
answer
320
views
Does absence of second pre-image resistance infer absence of pre-image resistance?
Talking about hash functions, I know the hierarchy is as follows:
Pre-image resistance
Second pre-image resistance
Collision resistance
Where each property implies the one before it so 2nd pre-...
- 851
1
vote
1
answer
412
views
Determining collision resistance of a function?
I am having trouble trying to understand if the function is collision resistant. As I understand it, preimage resistance means that it is hard for an adversary to find two messages that produce the ...
- 269
2
votes
1
answer
772
views
What is the complexity to break second preimage resistance?
In the context an of hash functions we have three required properties.
Preimage resistance
Second preimage resistance
Collision resistance.
The bounds for Pre image collision is $O(2^{n-1})$, the ...
- 431
4
votes
1
answer
368
views
Effect of message length on collision attacks
I know that message collisions are supposed to be hard to calculate for a good cryptographic hash.
Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash.
...
- 141
6
votes
1
answer
734
views
Fast 128-bit MAC with second preimage resistance?
I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
- 32k
4
votes
1
answer
202
views
Converting a pre-image resistant hash to second pre-image resistant
I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
- 2,661
20
votes
3
answers
976
views
Collision or second preimage for the ChaCha core?
Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words.
Can we exhibit collisions, or second-...
- 138k
3
votes
1
answer
363
views
Does SipHash have 64 bit (second) preimage security?
I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere.
I think it should be 64 bits, but I'd feel safer if somebody who has ...
- 989
1
vote
1
answer
766
views
Why Might XOR's Lead to Hash Functions Lacking 2nd Pre-image Resistance?
My hash function is as follows:
Cut the string in half (assume even length of 2m)
XOR's the two halves together
Take the result of the XOR and pass it to a function (a one-to-one and "onto" function) ...
- 115