Questions tagged [collision-attack]
For attacks on hash functions that achieve hash collisions with less work than the birthday bound.
25
questions
1
vote
2
answers
56
views
Does having a known suffix on the input to PBKDF2 make you more vulnerable?
I have an implementation of PBKDF2, which I know
Has two bytes of '=' at the end of the input
Has an input length of 24 (which is a Base64 encoded character representation of 16 bytes of entropy)
...
- 111
0
votes
0
answers
65
views
Having trouble providing a distinguisher proving this hash function is not collision-resistant
As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
0
votes
0
answers
42
views
On the exposition of SHA-1 attack (known_prefix + user_input + backend_secret)
In this question on sha1(known_prefix + user_input + backend_secret), an answer states that is realistically possible to find the first few bytes of ...
- 101
1
vote
0
answers
63
views
Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
1
vote
1
answer
242
views
Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
4
votes
1
answer
175
views
PRF collision search for input smaller than output
Assume a given pseudo-random function $H:\{0,1\}^a\mapsto\{0,1\}^b$ with $b\in[104,256]$ and $b/2<a<b$. We want to exhibit a collision if there is one, which has probability $>63\%$.
We are ...
- 138k
0
votes
0
answers
60
views
Hashing a seed full of entropy with a cryptographic hash function and emiting a key with the same size as input: can a collision attack occurs?
I read this in the documentation of HighwayHash:
By contrast, 'strong' hashes such as SipHash or HighwayHash require
infeasible attacker effort to find a hash collision (an expected 2^32
guesses of m ...
- 391
3
votes
1
answer
684
views
Quickest way to find MD5 collision
I'm trying to find a MD5 hash collision between 2 numbers such that one is prime and the other is composite (at most 1024-bit). I'm using fastcoll with random prefixes for each iteration.
For this I ...
- 161
2
votes
1
answer
94
views
How do the c-bits (capacity bits) make the sponge construction better?
I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
5
votes
0
answers
582
views
How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?
Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
- 153
3
votes
0
answers
134
views
Is WPA2 collision-proof?
I was experimenting with hashcat and aircrack to test WiFi security.
The WiFi AP is a WPA2 encrypted network. The tool I used to ...
- 31
2
votes
1
answer
757
views
Chosen Plain text attack [closed]
I have a course work for university, the question is:
Consider a symmetric encryption scheme with its encryption operation written as
$$C = E(K, R||P)$$
where $E$ is a block cipher encryption ...
- 77
0
votes
1
answer
51
views
MITM against NTRU
In MITM attacks against the NTRU cryptosystem, we exploit the fact that in the ring of truncated polynomials of degree $n-1$ it holds that $$fg=h\mod q$$ for our secret and public keys $f,h$. The ...
1
vote
1
answer
318
views
Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?
Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
- 11
1
vote
1
answer
336
views
Are these both the probability of collision in birthday attack?
About birthday attack,
book Cryptography Engineering says:
In general, if an element can take on N different values, then you can
expect the first collision after choosing about $\sqrt{N}$ random
...
- 151
2
votes
1
answer
1k
views
Understanding Hash collisions - why bad?
I read few answers about the question: why are hash collisions so dangerous?
But did not get a really satisfying answer.
Assume we are the first people who found a SHA256-collision, like
sha256($§&...
- 23
2
votes
2
answers
2k
views
Is there collision in encryption like in hash functions?
In hash functions, $h(m) = h(m_1)$ is called collision and is very undesired that they are feasible to find as it undermines hash security. However, is there essentially analogous concern in ...
- 71
3
votes
1
answer
102
views
How would a malicious group of co-signers use a hash collision to sign an unintended message?
According to BIP340:
However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
- 31
3
votes
1
answer
340
views
Collision finding method
The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
- 199
0
votes
2
answers
287
views
Does google's Shattered paper(The first collision for full SHA-1) mean creating a new file with the same hash as the original file?
I have a source data A and a hash H(A) of this A. Is it possible by google's shattered docs to create a new data B that outputs this H(A)?
++
I understood that the content of the paper is to ...
0
votes
2
answers
1k
views
Is it possible to get the SHA256 hash collision with partial known data
I have a text sentence that consists of 448 digits [0-9] [a-f] (in HEX format).
This text sentence is partially cut off, but I know the middle, and the beginning ...
1
vote
3
answers
212
views
Hash function collision importance
Suppose a collision has been found in a certain hash function,
such that H(x1) = H(x2)
However, x1 and x2 are both a seemingly 'random' collection of bits which do not convey a coherent message, and ...
- 11
1
vote
1
answer
157
views
Is recursive hashing cyclic?
If I feed the output of H back into H will it cover the entire output space of H before repeating?
Consider the following scenario:
...
4
votes
2
answers
2k
views
How easy is it to fake a file hashed with three functions, CRC32, MD5 and SHA-1?
File-A is hashed with CRC32, MD5 and SHA-1.
How easy is it to create a fake file-B that has the same hashes of file-A? CRC32, MD5 and SHA-1?
Can an average PC with a GPU calculate a triple hash ...
- 41
2
votes
1
answer
118
views
Finding $k$ strings $M_i$ such the XOR of the $k$ hashes $H(i,M_i)$ is zero
Let $k\ge2$ be a moderate given constant, and $H:[0,k)\times\{0,1\}^*\to\{0,1\}^b$ be a $b$-bit given hash function assimilated to a random oracle. For example $H(i,M)=\operatorname{SHAKE256}((\...
- 138k