We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [2nd-preimage-resistance]

Difficulty of finding another input string that hashes to the same value as a given string

Filter by
Sorted by
Tagged with
31
votes
1answer
21k views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = \operatorname{hash}...
19
votes
2answers
3k views

Why is Pearson hash not used as a cryptographic hash?

The original algorithm produces 1 byte long hash and is (of course) not suitable for cryptography use. But according to wikipedia, it is possible and easy to produce Pearson hash of any length, ...
19
votes
3answers
622 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
17
votes
1answer
7k views

Does collision resistance imply (or not) second-preimage resistance?

I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel: “Security ...
14
votes
2answers
6k views

Pre-image resistant but not 2nd pre-image resistant?

Are there any cryptographic hash functions for which there is a known pre-image attack, or a known second pre-image attack, but not both? The attack doesn't have to be practical - just anything that ...
13
votes
1answer
4k views

Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
12
votes
3answers
2k views

SHA3-255, one bit less

I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
11
votes
2answers
5k views

Why does second pre-image resistance imply pre-image resistance

I am studying hash functions. I can understand why collision resistance implies second preimage resistance, but I don't get why second preimage resistance should imply first preimage resistance. ...
11
votes
1answer
2k views

Why doesn't preimage resistance imply the second preimage resistance?

Let the preimage resistance be defined as »given a hash value $h$, it is hard to find any message $m$ such that $\operatorname{hash}(m)=h$«, and let the second preimage resistance be defined as »given ...
11
votes
1answer
496 views

Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
9
votes
1answer
3k views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
7
votes
3answers
8k views

The difference between being not strongly collision resistant, and not weakly collision resistant?

So I understand the two concepts: (Strong) collision resistance: it is infeasible to find a pair $x \neq x'$ such that $h(x) = h(x')$ Weak collision resistance / 2nd-preimage resistance: for all $x \...
6
votes
1answer
153 views

Has there ever been more then a theoretical difference between preimage resistance and second preimage resistance?

In other words, has there ever been a point in time in which having the content of a message has actually helped break a hash function?
5
votes
1answer
530 views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
5
votes
2answers
185 views

usefulness of a collision attack that's not also a 2nd pre-image attack

So my understanding is that if we've got some hash function $H$ then a 2nd pre-image attack is one where given a message-hash pair $(m, H(m))$ we can find some $m' \neq m : H(m') = H(m)$, while a ...
5
votes
1answer
294 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
5
votes
1answer
105 views

Second preimage attack complexity when the digest is malleable

An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. ...
4
votes
1answer
823 views

Is $H(x) = x^2 \bmod p$ pre-image resistant, second pre-image resistant and/or collision resistant

I have the function $H(x) = x^2\bmod p$ , where $p$ is a prime of length n bits and this function maps to the message $x$ to a n-bit hash value $H(x)$. I need to find out if it is pre-image resistant,...
4
votes
1answer
298 views

How can I determine if a hash function is secure?

I'm doing an exam in computer security and I encountered this problem which I'm unsure of how to attack properly. Should I get down and dirty with the Hash function on paper or is there a more general ...
4
votes
2answers
7k views

Computational requirements for breaking SHA-256?

Let's define "breaking" a hash function $H$ as being threefold (corresponding to the main properties of a cryptographic hash function): preimage attacks to get $m$ knowing $H(m)$ second-preimage ...
4
votes
1answer
709 views

Functions that are only second-preimage resistant?

Are there functions that satisfy the second-preimage resistance property without satisfying the others (preimage and collision resistance) ? I'm looking about such functions that compress data (exit ...
4
votes
1answer
170 views

Effect of message length on collision attacks

I know that message collisions are supposed to be hard to calculate for a good cryptographic hash. Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash. ...
4
votes
1answer
166 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
3
votes
3answers
819 views

Computational feasible to reverse MD5SUM?

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size $N$ whose MD5SUM is $X$? For example, ...
3
votes
2answers
343 views

What, cryptographically speaking, is a “long message”?

I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message". Also, do long message attacks only apply ...
3
votes
2answers
3k views

Difference between collision resistance and target collision resistance

For a hash function, what's the difference between Collision Resistance and Target Collision Resistance?. I understand the definition of hash function collision resistance, but I don't know about ...
3
votes
1answer
408 views

Difference between second pre-image resistance attack and collision attack

According to my understanding of hashing algorithms -: Collision attack is an attack wherein we have a hash(x) and we try to find hash(y) such that x!=y while hash(x)=hash(y). Second pre-image ...
3
votes
1answer
800 views

Winternitz One time signature security

There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$ Security of both is as following $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...
3
votes
1answer
571 views

Why do different applications of hash functions demand different properties of the hash function?

A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
3
votes
1answer
625 views

Difficulty of collision vs preimage vs second-preimage attacks

It seems at first glance that brute-forcing a collision would be exactly as difficult for all of them. They all (I would expect) work like this: select a hash value, and then try messages to get an ...
3
votes
1answer
78 views

Security implications of slow-by-design hashes on relative security vs. hash size

Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design? Example: let's say you want 128-bit hashes. This is ...
3
votes
1answer
210 views

Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere. I think it should be 64 bits, but I'd feel safer if somebody who has ...
3
votes
1answer
399 views

Increased security weaknesses when truncating SHA1

Given the following preconditions: A plaintext A (~512bit length), that is hashed by using SHA-1 and truncated to (the first) 64 bits. I know both, the plaintext and the truncated hash, and want ...
3
votes
0answers
1k views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
2
votes
2answers
525 views

collisions on hash functions

Why do we say that collision-resistance is a "harder" property than second pre-image for hash functions whereas if you have an attack on the second pre-image then you find a collision ? Moreover, a ...
2
votes
1answer
340 views

What is the complexity to break second preimage resistance?

In the context an of hash functions we have three required properties. Preimage resistance Second preimage resistance Collision resistance. The bounds for Pre image collision is $O(2^{n-1})$, the ...
2
votes
1answer
282 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
2
votes
1answer
369 views

Hash-based signature scheme XMSS/LMS susceptible to preimage/second preimage attack?

Are the quantum secure hash based signatures (XMSS/LMS) susceptible to preimage/second preimage attack?
2
votes
1answer
83 views

Cryptographic hash function based on logistic map?

Is there any secure cryptographic hash function based on the logistic map?
1
vote
1answer
226 views

Hashing based on the discrete logarithm problem

At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup). Additionally, $H(x)$ ...
1
vote
1answer
216 views

Question about second preimage resistance of hash function combiner

Let $\Pi=(Gen_1,H_1)$ and $\Pi=(Gen_2,H_2)$ be two hash functions. Define $(Gen, H)$ so that $Gen$ runs $Gen_1$ and $Gen_2$ obtaining $s_1$ and $s_2$ respectively. Then let $H^{s_1,s_2}(x)=H^{s_1}(x)\|...
1
vote
1answer
194 views

Does absence of second pre-image resistance infer absence of pre-image resistance?

Talking about hash functions, I know the hierarchy is as follows: Pre-image resistance Second pre-image resistance Collision resistance Where each property implies the one before it so 2nd pre-...
1
vote
1answer
58 views

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case : ...
1
vote
1answer
131 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
1
vote
1answer
376 views

Why Might XOR's Lead to Hash Functions Lacking 2nd Pre-image Resistance?

My hash function is as follows: Cut the string in half (assume even length of 2m) XOR's the two halves together Take the result of the XOR and pass it to a function (a one-to-one and "onto" function) ...
1
vote
1answer
138 views

Create a potential input for sha-256 hash given a substring of input?

Let's say I'm given a specific SHA-256 hash. Further assume that the SHA-256 input, that yielded this hash contained a known sub-string. Is there a way to find the input (containing the specific ...
1
vote
1answer
141 views

Determining collision resistance of a function?

I am having trouble trying to understand if the function is collision resistant. As I understand it, preimage resistance means that it is hard for an adversary to find two messages that produce the ...
1
vote
1answer
261 views

Near preimages, applicable to Bitcoin?

Bitcoin mining relies on generating a smaller hash than the so-called target (a function of the so-called difficultly), thus is vulnerable to a truncated preimage attack (you just need to obtain a ...
1
vote
0answers
64 views

Why does second pre-image resistance imply pre-image resistance? [duplicate]

Definitions here: Pre-image resistance Given a hash value h it should be difficult to find any message m such that ...
0
votes
1answer
70 views

Second Preimages on n-bit Hash Functions by John Kelsey and Bruce Schneier

I read your https://www.schneier.com/academic/paperfiles/paper-preimages.pdf And found there: «3.2 A Generic Technique: Multicollisions of Different Lengths» <...