Skip to main content

Questions tagged [2nd-preimage-resistance]

Difficulty of finding another input string that hashes to the same value as a given string

Filter by
Sorted by
Tagged with
4 votes
1 answer
84 views

Security impact of weakened collision resistance for 128-bit Fiat-Shamir challenges

As I understand, to achieve a security level of $\lambda$, a hash function's output should be at least $2\lambda$ in length, since the search space is halved for collision resistance. However, I am ...
Taka's user avatar
  • 43
3 votes
0 answers
117 views

Sponge capacity feed-forward

Consider Sponge construction where capacity part of state is feed-forward and xor-ed into next state. ${state}_{i+1} = F({{state}_i}^{rate} || {{state}_i}^{capacity}) \oplus (0^{rate} || {{state}_i}^{...
LightBit's user avatar
  • 1,659
1 vote
0 answers
231 views

Complete Binary Merkle Tree and second pre-image attack

To prevent second pre-image attacks, the Merkle Tree implementations I've looked at add a 0 prefix to the leaves and a 1 prefix ...
GuestMeNot's user avatar
0 votes
0 answers
148 views

Is this implementation of Merkle Trees susceptible to second preimage attack?

I am trying to find a good implementation of Merkle Tree generation in Golang, and I need the tree to be resilient to Second Preimage Attack I have found this standard implementation in the golang ...
Barney Chambers's user avatar
0 votes
0 answers
16 views

How to assign md5 of another file to one wav file? [duplicate]

Good afternoon . Please tell me how to change the md5 hash of one wav file to the md5 hash of another wav file. I want to bypass the anti-cheat check on md5. Maybe there are online paid services? I ...
DEFJAM's user avatar
  • 1
2 votes
0 answers
130 views

Why this function isn't second preimage resistant?

Why is $h(k,m)$ not second-preimage resistant? Let $E_k$ be a block cipher where the message space is the same as the key space. $$h(k,m)=E_k(m\oplus k)\oplus k$$ I've been reading about second ...
Emma's user avatar
  • 21
1 vote
1 answer
5k views

Unhash possible? How got this user the unhash?

in this post Why can't we reverse hashes? there is an unhash of "Hello World". How did that work? If there is no function to find it, where does it come from?
user avatar
1 vote
0 answers
48 views

Finding second-preimage to this use of weak hash

$h'(x) := h(a_1 \parallel x \parallel b_1) \parallel h(a_2 \parallel x \parallel b_2) \parallel h(a_3 \parallel x \parallel b_3) \parallel \dots \parallel h(a_k \parallel x \parallel b_k)$ $a_i$ and $...
ashidc's user avatar
  • 43
0 votes
1 answer
47 views

Finding multiple smaller collisions equal work as finding a bigger collision?

Problem A: I receive two hash digests $H(x), H(y)$ and the corresponding preimages $(x, y)$. $H$ is a 128-bit cryptographic hash function: $H: \{0,1\}^{*} \longrightarrow \{0, 1\}^{128}$ I need to ...
Neal Page's user avatar
3 votes
2 answers
311 views

Application of cryptographic hash functions which do not require collision resistance property

I can not understand why collision resistance of a cryptographic hash function is not required for some applications. for example, if we store the trusted hash of a file or program, and later when we ...
John's user avatar
  • 43
4 votes
1 answer
589 views

What are the “costs” to find a pre-image, weak collision, or strong collision?

For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
Renato's user avatar
  • 43
1 vote
1 answer
188 views

Can we use a Merkle Tree structure to reduce digest size?

A 2nd preimage attack is possible on the standard Merkle tree as pictured below. I'm aware that we can add identifiers (to differentiate nodes) to the input of each hash as discussed in the link. If ...
Modal Nest's user avatar
  • 1,453
2 votes
1 answer
302 views

Practicality of a certain hash function

Consider the following hash function: $$(V\cdot A + V\cdot B)^2 \bmod C$$ $A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
Sir Galahad's user avatar
4 votes
1 answer
899 views

Why this isn't second preimage resistance?

I've been reading on preimage resistance and trying out few examples for the same and I'm trying to figure out why the following hash function does not have the second preimage resistance and any ...
Alex's user avatar
  • 341
1 vote
1 answer
293 views

finding second pseudo preimage faster than brute force

As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
abbas's user avatar
  • 175
2 votes
1 answer
315 views

Is an HMAC based on a second-preimage resistant hash function always unforgeable?

If hash function is collision-resistant, then its associated HMAC is always unforgeable. But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant. Then ...
Keshav Srinivasan's user avatar
3 votes
1 answer
611 views

Do hash functions for digital signatures need to be preimage resistant?

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
XDAF's user avatar
  • 159
4 votes
2 answers
2k views

Are My Answers to This Hash Question Correct?

Question When determining the security of a hash system, the cryptanalyst tries the following attacks. (a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
John's user avatar
  • 43
3 votes
1 answer
53 views

How to find k-way second preimages

For example: Assuming someone has found a second preimage for SHA-256. In other words, for SHA256(M1)=H, someone has found M2 which SHA256(M2)=H Now, is it possible to generate k-way second ...
Anonymous's user avatar
  • 153
1 vote
0 answers
60 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
Kirill's user avatar
  • 55
6 votes
2 answers
4k views

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

I found a hashcat benchmark results in the internet: hashcat results: SHA-384 is 17065.4 MH/s SHA-512 is 17280.3 MH/s Why does SHA-512 take less time? SHA-512 is longer and I thought it therefore ...
sluge's user avatar
  • 197
1 vote
1 answer
246 views

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case : ...
user2284570's user avatar
12 votes
3 answers
3k views

SHA3-255, one bit less

I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
ragazzojp's user avatar
  • 413
4 votes
0 answers
270 views

Second preimage attack complexity when the digest is malleable

An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. ...
forest's user avatar
  • 15.3k
2 votes
1 answer
171 views

Cryptographic hash function based on logistic map?

Is there any secure cryptographic hash function based on the logistic map?
LinusK's user avatar
  • 217
7 votes
2 answers
2k views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
RocketNuts's user avatar
  • 1,387
2 votes
1 answer
932 views

Hashing based on the discrete logarithm problem

At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup). Additionally, $H(x)$ ...
Lucian Boca's user avatar
2 votes
2 answers
596 views

collisions on hash functions

Why do we say that collision-resistance is a "harder" property than second pre-image for hash functions whereas if you have an attack on the second pre-image then you find a collision ? Moreover, a ...
tyuil's user avatar
  • 217
3 votes
1 answer
155 views

Security implications of slow-by-design hashes on relative security vs. hash size

Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design? Example: let's say you want 128-bit hashes. This is ...
Adam Ierymenko's user avatar
4 votes
1 answer
1k views

How can I determine if a hash function is secure?

I'm doing an exam in computer security and I encountered this problem which I'm unsure of how to attack properly. Should I get down and dirty with the Hash function on paper or is there a more general ...
Mountain_sheep's user avatar
1 vote
1 answer
402 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
Kostas Kryptos's user avatar
2 votes
1 answer
616 views

Hash-based signature scheme XMSS/LMS susceptible to preimage/second preimage attack?

Are the quantum secure hash based signatures (XMSS/LMS) susceptible to preimage/second preimage attack?
Nathan Aw's user avatar
  • 2,277
3 votes
1 answer
956 views

Difference between second pre-image resistance attack and collision attack

According to my understanding of hashing algorithms -: Collision attack is an attack wherein we have a hash(x) and we try to find hash(y) such that x!=y while hash(x)=hash(y). Second pre-image ...
Skynet's user avatar
  • 133
3 votes
1 answer
1k views

Winternitz One time signature security

There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$ Security of both is as following $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...
Infinity's user avatar
  • 575
6 votes
2 answers
22k views

Computational requirements for breaking SHA-256?

Let's define "breaking" a hash function $H$ as being threefold (corresponding to the main properties of a cryptographic hash function): preimage attacks to get $m$ knowing $H(m)$ second-preimage ...
indiscreteLog's user avatar
-1 votes
1 answer
196 views

How many hash functions must Bob compute to find a solution?

Alice proposes the following puzzle to be completed. Let m be the body of the email message, let a be the recipient’s email address, let H( )be the hash function SHA3-256, ...
xxx's user avatar
  • 11
3 votes
1 answer
2k views

Difficulty of collision vs preimage vs second-preimage attacks

It seems at first glance that brute-forcing a collision would be exactly as difficult for all of them. They all (I would expect) work like this: select a hash value, and then try messages to get an ...
ispiro's user avatar
  • 2,025
0 votes
1 answer
110 views

Second Preimages on n-bit Hash Functions by John Kelsey and Bruce Schneier

I read your https://www.schneier.com/academic/paperfiles/paper-preimages.pdf And found there: «3.2 A Generic Technique: Multicollisions of Different Lengths» <...
user41204's user avatar
5 votes
2 answers
273 views

usefulness of a collision attack that's not also a 2nd pre-image attack

So my understanding is that if we've got some hash function $H$ then a 2nd pre-image attack is one where given a message-hash pair $(m, H(m))$ we can find some $m' \neq m : H(m') = H(m)$, while a ...
alfalfa's user avatar
  • 153
4 votes
1 answer
1k views

Why do different applications of hash functions demand different properties of the hash function?

A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
Minaj's user avatar
  • 1,090
19 votes
2 answers
4k views

Why is Pearson hash not used as a cryptographic hash?

The original algorithm produces 1 byte long hash and is (of course) not suitable for cryptography use. But according to wikipedia, it is possible and easy to produce Pearson hash of any length, simply ...
johnfound's user avatar
  • 293
1 vote
1 answer
711 views

Create a potential input for sha-256 hash given a substring of input?

Let's say I'm given a specific SHA-256 hash. Further assume that the SHA-256 input, that yielded this hash contained a known sub-string. Is there a way to find the input (containing the specific ...
Greaterlol's user avatar
2 votes
1 answer
327 views

Does absence of second pre-image resistance infer absence of pre-image resistance?

Talking about hash functions, I know the hierarchy is as follows: Pre-image resistance Second pre-image resistance Collision resistance Where each property implies the one before it so 2nd pre-...
Silverfox's user avatar
  • 881
1 vote
1 answer
431 views

Determining collision resistance of a function?

I am having trouble trying to understand if the function is collision resistant. As I understand it, preimage resistance means that it is hard for an adversary to find two messages that produce the ...
winsticknova's user avatar
2 votes
1 answer
826 views

What is the complexity to break second preimage resistance?

In the context an of hash functions we have three required properties. Preimage resistance Second preimage resistance Collision resistance. The bounds for Pre image collision is $O(2^{n-1})$, the ...
Anonymous's user avatar
  • 431
4 votes
1 answer
375 views

Effect of message length on collision attacks

I know that message collisions are supposed to be hard to calculate for a good cryptographic hash. Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash. ...
Rahly's user avatar
  • 141
6 votes
1 answer
753 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
otus's user avatar
  • 32.2k
4 votes
1 answer
205 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
juaninf's user avatar
  • 2,711
20 votes
3 answers
1k views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
fgrieu's user avatar
  • 142k
3 votes
1 answer
378 views

Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere. I think it should be 64 bits, but I'd feel safer if somebody who has ...
Chris's user avatar
  • 999