Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [collision-attack]

For attacks on hash functions that achieve hash collisions with less work than the birthday bound.

Filter by
Sorted by
Tagged with
1 vote
0 answers
42 views

Number of iterations needed for "distinguished points" hash collision finding algorithm?

I'm currently implementing the "distinguished points" collision finding algorithm on SHA-3 reduced to a lower number of bits. Let's say I'm going to find one collision on SHA-3-256bits ...
Froest's user avatar
  • 11
0 votes
2 answers
114 views

How to generate an arbitrary file matching a given MD5 hash? [duplicate]

I have an MD5 hash and need to generate a file that matches it. There are absolutely no constrains on the contents of said file, it can be binary gibberish. The only important thing is that it matches ...
Werdck's user avatar
  • 11
1 vote
2 answers
57 views

Does having a known suffix on the input to PBKDF2 make you more vulnerable?

I have an implementation of PBKDF2, which I know Has two bytes of '=' at the end of the input Has an input length of 24 (which is a Base64 encoded character representation of 16 bytes of entropy) ...
Evan Carroll's user avatar
0 votes
0 answers
78 views

Having trouble providing a distinguisher proving this hash function is not collision-resistant

As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
HughJass24's user avatar
0 votes
0 answers
43 views

On the exposition of SHA-1 attack (known_prefix + user_input + backend_secret)

In this question on sha1(known_prefix + user_input + backend_secret), an answer states that is realistically possible to find the first few bytes of ...
wjwrpoyob's user avatar
  • 101
1 vote
0 answers
72 views

Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
1 vote
1 answer
359 views

Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
4 votes
1 answer
181 views

PRF collision search for input smaller than output

Assume a given pseudo-random function $H:\{0,1\}^a\mapsto\{0,1\}^b$ with $b\in[104,256]$ and $b/2<a<b$. We want to exhibit a collision if there is one, which has probability $>63\%$. We are ...
fgrieu's user avatar
  • 142k
0 votes
0 answers
70 views

Hashing a seed full of entropy with a cryptographic hash function and emiting a key with the same size as input: can a collision attack occurs?

I read this in the documentation of HighwayHash: By contrast, 'strong' hashes such as SipHash or HighwayHash require infeasible attacker effort to find a hash collision (an expected 2^32 guesses of m ...
alpominth's user avatar
  • 393
3 votes
1 answer
1k views

Quickest way to find MD5 collision

I'm trying to find a MD5 hash collision between 2 numbers such that one is prime and the other is composite (at most 1024-bit). I'm using fastcoll with random prefixes for each iteration. For this I ...
infinite-blank-'s user avatar
2 votes
1 answer
126 views

How do the c-bits (capacity bits) make the sponge construction better?

I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
questions change the world's user avatar
5 votes
0 answers
609 views

How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
user2284570's user avatar
3 votes
0 answers
175 views

Is WPA2 collision-proof?

I was experimenting with hashcat and aircrack to test WiFi security. The WiFi AP is a WPA2 encrypted network. The tool I used to ...
Kristi's user avatar
  • 31
2 votes
1 answer
884 views

Chosen Plain text attack [closed]

I have a course work for university, the question is: Consider a symmetric encryption scheme with its encryption operation written as $$C = E(K, R||P)$$ where $E$ is a block cipher encryption ...
hasin's user avatar
  • 77
0 votes
1 answer
62 views

MITM against NTRU

In MITM attacks against the NTRU cryptosystem, we exploit the fact that in the ring of truncated polynomials of degree $n-1$ it holds that $$fg=h\mod q$$ for our secret and public keys $f,h$. The ...
Creeptographer's user avatar
1 vote
1 answer
369 views

Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?

Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
user13129201's user avatar
1 vote
1 answer
378 views

Are these both the probability of collision in birthday attack?

About birthday attack, book Cryptography Engineering says: In general, if an element can take on N different values, then you can expect the first collision after choosing about $\sqrt{N}$ random ...
Tim's user avatar
  • 151
2 votes
1 answer
1k views

Understanding Hash collisions - why bad?

I read few answers about the question: why are hash collisions so dangerous? But did not get a really satisfying answer. Assume we are the first people who found a SHA256-collision, like sha256($§&...
ZPlaya7's user avatar
  • 23
2 votes
2 answers
2k views

Is there collision in encryption like in hash functions?

In hash functions, $h(m) = h(m_1)$ is called collision and is very undesired that they are feasible to find as it undermines hash security. However, is there essentially analogous concern in ...
nimrodel's user avatar
3 votes
1 answer
108 views

How would a malicious group of co-signers use a hash collision to sign an unintended message?

According to BIP340: However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
scottmsul's user avatar
3 votes
1 answer
354 views

Collision finding method

The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
Kuba Chrabański's user avatar
0 votes
2 answers
304 views

Does google's Shattered paper(The first collision for full SHA-1) mean creating a new file with the same hash as the original file?

I have a source data A and a hash H(A) of this A. Is it possible by google's shattered docs to create a new data B that outputs this H(A)? ++ I understood that the content of the paper is to ...
DownTop_oil's user avatar
0 votes
2 answers
1k views

Is it possible to get the SHA256 hash collision with partial known data

I have a text sentence that consists of 448 digits [0-9] [a-f] (in HEX format). This text sentence is partially cut off, but I know the middle, and the beginning ...
Dew Debra's user avatar
1 vote
3 answers
264 views

Hash function collision importance

Suppose a collision has been found in a certain hash function, such that H(x1) = H(x2) However, x1 and x2 are both a seemingly 'random' collection of bits which do not convey a coherent message, and ...
Arik's user avatar
  • 11
1 vote
1 answer
173 views

Is recursive hashing cyclic?

If I feed the output of H back into H will it cover the entire output space of H before repeating? Consider the following scenario: ...
Sherwood Botsford's user avatar
4 votes
2 answers
2k views

How easy is it to fake a file hashed with three functions, CRC32, MD5 and SHA-1?

File-A is hashed with CRC32, MD5 and SHA-1. How easy is it to create a fake file-B that has the same hashes of file-A? CRC32, MD5 and SHA-1? Can an average PC with a GPU calculate a triple hash ...
user94388's user avatar
2 votes
1 answer
126 views

Finding $k$ strings $M_i$ such the XOR of the $k$ hashes $H(i,M_i)$ is zero

Let $k\ge2$ be a moderate given constant, and $H:[0,k)\times\{0,1\}^*\to\{0,1\}^b$ be a $b$-bit given hash function assimilated to a random oracle. For example $H(i,M)=\operatorname{SHAKE256}((\...
fgrieu's user avatar
  • 142k