Questions tagged [collision-resistance]

Difficulty of finding two different inputs that hash to the same value

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

Does every 256 bit number have a distinct sha256 result? [duplicate]

If I were some how able to create a table of all 256 bit inputs and outputs of sha256, would each of the inputs have a distinct output?
0
votes
0answers
33 views

How to create two partly similar plaintexts with same MD5 hash value?

The problem I'd like to solve looks like this: There are two plaintexts which differ in length and letters, but contain a few common strings. The first few words and the last few words are the same, ...
1
vote
1answer
57 views

If I concatenate two colliding SHA-256 messages with the same prefix and suffix, will the resulting hash output still collide with each other?

So let's say that there are two messages, $x_1$ and $x_2$, which hash to the same output. In other words, these two messages collide with each other: $$\operatorname{SHA256}(x_1)=\operatorname{SHA256}...
2
votes
1answer
63 views

For SHA3-512, SHA512, and Whirlpool, which algorithm has least probability for collision and preimage collision?

For comparing these 3 hash functions SHA3-512, SHA512, and Whirlpool. Which one is strongest against collision and preimage attacks. Are they fundamentally the same because of the same size output? ...
1
vote
3answers
134 views

Identifying identical files without reading them completely

Imagine the following situation: there are many "big" files (100Gb+) lying on 2 different remote servers you have no direct access to these files you can only read a small amount of each file (e.g. ...
0
votes
0answers
31 views

Finding a hash function that calculates average of an item in a stream of tuples

So, I have a stream of tuples coming in for example [country, state, person], where state and person are unique items. Now I have to find : 1. for each country, I have to estimate average number of ...
2
votes
2answers
84 views

Do hash collisions persist if a file is modified?

Suppose I use a relatively insecure hash algorithm to digitally sign a contract. Suppose also that creating a fraudulent contract with the same hash, a collision, is practical. As I understand, in ...
0
votes
0answers
45 views

Collision resistance

I have function with input 128 bit and output 64 bit that hash the header and hash the payload then concatenating them after that hash the result so my question is does this pass the collision ...
0
votes
0answers
12 views

Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]

there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm. I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
7
votes
4answers
282 views

Can I replace SHA-1 with SHA-512/160 to address Shambles?

The destination is software (within a remote trust boundary) that expects SHA-1 results. Would it be safer for the source (that's within my own trust boundary) to replace my SHA-1 computation at my ...
16
votes
1answer
4k views

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

In a recent study SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust by Gaëtan Leurent and Thomas Peyrin. 2020, they showed the first practical chosen-...
3
votes
1answer
92 views

Can the confusion/diffusion of a hash algorithm be quantified?

I am wondering whether the confusion and diffusion are quantified in any way when we examine hashing algorithms and, if so, how they are quantified and what units (if any) are used to represent them.
4
votes
2answers
197 views

“One-Wayness” of SHA 1

I recently started learning about Hash Functions for my first time, and I've gone through and have tried to understand the SHA1 process. Brilliant does an excellent job of explaining it step by step. ...
6
votes
1answer
113 views

Do a 160-bit SHA-1 hash and a 160-bit slice of a SHA-256 hash have the same strength in terms of collision-free?

Take OpenPGP fingerprint for example. If the 40-digit hex standard remains unchanged, would it be helpful to upgrade SHA-1 to SHA-256 (but only taking the last 160 bits), in terms of reducing the risk ...
2
votes
2answers
243 views

Does stronger cryptographic hashes also imply being better at verifying integrity?

What I know so far Fact 1) I know that all cryptographic hash functions have the following properties They are many-to-one in nature They produce fixed size outputs Given an output ...
0
votes
0answers
94 views

Is md5(x) xor md4(x) collision proof?

Suppose I have the following hash function: $\newcommand{\md}[1]{\text{md#1}} \newcommand{\H}{\text{H}}$ $$\H(x, y) = \md{5}(x) \oplus \md{4}(y)$$ How can I prove it's collision proof? I tried to ...
1
vote
1answer
60 views

Any known cases of lucky collisions resulting in security breaches?

This isn't a deep technical question, but I feel like this is a good place to ask. Modern cryptography generally rely on statistical chances of collisions according to current computing powers. Are ...
4
votes
1answer
279 views

Is length extension attack considered as collision?

I came across a few articles about length extension attacks on cryptographic hash functions. I was very surprised to read that SHA-256 and SHA-512 are prone to length extension attacks. This seems ...
2
votes
1answer
72 views

Merkle–Damgård transformation example

I m looking at this Example of Merkle–Damgård I have a similar question about this topic. I have hash function maps 256b blocks into 128b blocks, how many rounds are required for hashing a 140KB ...
0
votes
0answers
44 views

Probability of collision of two HMACs with two random keys

Assume $k_1$ and $k_2$ are two $\lambda$ bit random number ($|k_1|=|k_2|=\lambda$), and HMAC generates $f(\lambda)$ bit tag. How much is the probability of their collision for an input message $m$? $...
8
votes
1answer
638 views

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest): Level I: ...
0
votes
1answer
129 views

If multiple hashing algorithms are chained together, is the compound hash function more collision resistant? [duplicate]

The DASH cryptocurrency uses X11, which is a Proof of Work hashing algorithm composed of 11 separate hash functions which are run as a sequence. Example: $Digest = H_{11}...(H_3(H_2(H_1(Input))))$ ...
1
vote
1answer
63 views

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case : ...
1
vote
2answers
89 views

For data shorter than 32 bytes, is it sure that no collision exists?

I’m not talking about if a collision can be found but even simply exists. The point is since it’s shorter than the length of the hash (since I’m talking about keccak256), normally there’s a hash ...
2
votes
2answers
76 views

Collision resistant functions - definition

Let $f$ be a collision resistant function i.e. it is computationally impossible to find $x_0, x_1$ such that $f(x_0) = f(x_1)$. If a computationally bounded adversary demonstrates that he knows some $...
12
votes
3answers
2k views

SHA3-255, one bit less

I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
4
votes
0answers
89 views

Parameters for high density SIS

I am considering the SIS problem of finding $x\in \mathbb{Z}^m$ such that for random $A\in\mathbb{Z}_q^{n\times m}$, $Ax=0$ and $\lVert x\rVert < \beta$ for some $p$-norm and bound $\beta < q$. ...
6
votes
0answers
130 views

Are there two known ASCII-only strings which have the same MD5 hash value?

Up to now, the pairs of strings that create an MD5 collision that have been discovered all contain non-ASCII (binary) characters. Are there two known ASCII-only strings which have the same MD5 hash ...
0
votes
0answers
33 views

Help, Feedback and Solutions to a problem on a PoC CSPRNG

Background I do not recommend trying to roll your own crypto. This is just a for-fun PoC, which won't be used in any public or private scenario. I am creating a PoC nearly-true random number ...
4
votes
2answers
1k views

Why this brute force attack doesn't reduce all cryptographic hash functions' security bits against collision attacks to N/3?

The traditional brute force collision attack is generate $2^{N/2}$ (unique) random strings, hash them and this results in ~50% chance for collision. The attack talked in the question's title is ...
1
vote
2answers
300 views

How to prove if a Hash Function is collision resistant

Say we have the following Hash Function, H(x) = 4x mod N where N is a number generated by multiplying two prime numbers and x={0,1,2,3,...,N-1}. So lets assume that ...
1
vote
1answer
98 views

What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?

Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
4
votes
1answer
144 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
3
votes
1answer
105 views

Is it feasible to find n hashes that sum up to a given hash?

Consider two sets $A=\{a_1,a_2,\cdots,a_n\}, B=\{b_1,b_2,\cdots,b_m\}$; We can calculate the hash sum of those sets: $$HASHSUM(𝐴)=(ℎ𝑎𝑠ℎ(a_1)+ ℎ𝑎𝑠ℎ(𝑎_2)+\cdots +ℎ𝑎𝑠ℎ(𝑎_𝑛))$$ and $$HASHSUM(𝐵...
1
vote
2answers
67 views

How many hash collision will exist where the digest is a pre-image?

This question follows on from the question Circular hash collision where digest is pre-image: Could hash(a) = b, hash(b)=c, then hash(c)=a? The question was answered but the issue of the number of ...
0
votes
1answer
94 views

How does concatenating diverse hash functions affect collision resistance?

Let's suppose I take 3 different types of hash functions and concatenate them for future safety so that: digest = Hash3( Hash2( Hash1( text ))) Does the birthday attack mean in this case that I must ...
0
votes
1answer
390 views

Strongest collision resistance test?

An administrator is testing the collision resistance of different hashing algorithms. Which of the following is the strongest collision resistance test? A. Find two identical messages with different ...
2
votes
1answer
122 views

Simple commitment scheme using secure hash function

Can I create a simple commitment scheme using a secure hash function? If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random\_string || message)$) Thank you
1
vote
1answer
119 views

Is it possible to truncate AES output and keep uniqueness (no decryption needed)? [duplicate]

I would like to hash numbers less than 1000000000, so generally they could be stored on 30 bits. The aim is to obtain numbers that are not reversible, so my initial plan was to use SHA256 (with some ...
3
votes
1answer
122 views

Please explain me why we require $2^m$ & $2^{\frac{m}{2}}$ random messages

Assume that a one-way Hash function is secure and the best way to attack it is by using the brute force attack. It produces an $m$-bit output. Finding a message that hashes to a given hash value would ...
1
vote
1answer
92 views

collision resistance of a composed hash function

Given a collision-resistant hash function $H(x)$, say SHA256, and I devise another hash function by $H'(x)=\sum^{m}_{1}H(x||i) \mod p$. The summation is defined on finite field of prime order $p$. ...
3
votes
1answer
60 views

Security issues with computing parallel hashes?

One issue with most hash algorithms like SHA-256 is that it is inherently serial. You can't effectively use SIMD to parallelize a single SHA-256 calculation. However, you can calculate multiple SHA-...
2
votes
1answer
198 views

Collision resistant hash function implies one-way function

I'm struggling to give a formal proof that $CRH \implies OWF$ using the definition below. Intuitively, I see why a $CRH$ would be "hard to predict" and might be used as a $PRF$, but I'm unable to ...
2
votes
1answer
105 views

How secure is a hash based signature scheme after signing assuming quantum computers?

Consider a hash based signature scheme that requires taking the $k$-bit hash of an arbitrary length message to be signed (e.g. Lamport one-time signature scheme). My understanding is, assuming that ...
5
votes
2answers
224 views

Collision resistance of partial SHA-256 hashes XOR'ed

My hashing algorithm computes the SHA-256 for each of 12 input strings and XORs them to get the final hash. Is there a risk of an attacker being able to forge 2 sets of inputs that yield the same ...
2
votes
0answers
56 views

Estimating the Security of SIS-Based Signature, by verifiying a subset of coordinates?

As I understood, the GPV signature scheme works as follows: KeyGen($1^n$) : Generate a Lattice with public $A \in Z_q^{n.m}$ and a secret trapdoor $t$. Sign $m$: compute $\vec y = H(m) \in Z_q^n$ ...
1
vote
1answer
87 views

Are Merkle Dags really Dags in most cases?

Let $H$ a cryptographic hash function of image length $n+1$ and $s_0$, $s_1$, ... , $s_k$ a finite sequence of bitstrings (length $>n+1$), such that $s_j$ contains a hash of $s_{j-1}$ for all $1\...
1
vote
1answer
118 views

Birthday attack on hash functions derived from a collision-resistant hash function [closed]

$H_1$ is a collision-resistant hash function with an $L$-bit output. 2 hash functions are created based on it as follows: $$H_2((k_1,k_2);m) = (H_1(k_1;m), \space H_1(k_2;m))$$ $$H_3((k_1,k_2);(m_1,...
17
votes
3answers
3k views

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

I want to use a hash function to generate a random sequence from number 0-n. And so I would like to find a good function that results in values that are seemingly random (does not need to be secure), ...
2
votes
1answer
56 views

1 round Feistel with birthday attack

This is a reprise of an earlier question of mine, and I'm sorry if it's repetitious; I'm going at it with a different strategy. In an exercise I was given a 1-round Feistel network which uses $H(k \...

1
2 3 4 5
11