Questions tagged [collision-resistance]

Difficulty of finding two different inputs that hash to the same value

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
14 votes
0 answers
222 views

Space complexity of quantum collision search?

Is there a known way to reduce the space complexity of quantum collision search (PDF) beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below ...
user avatar
7 votes
0 answers
389 views

Are there two known ASCII-only strings which have the same MD5 hash value?

Up to now, the pairs of strings that create an MD5 collision that have been discovered all contain non-ASCII (binary) characters. Are there two known ASCII-only strings which have the same MD5 hash ...
bcgyh's user avatar
  • 71
5 votes
0 answers
150 views

Challenging $O(2^{n/2})$ for hash collisions using quantum computers

In "Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound" the authors Akinori Hosoyamada and Yu Sasaki state that it may ...
Maarten Bodewes's user avatar
  • 92.3k
4 votes
0 answers
141 views

Is the XOR-combiner of independent keyed hash-functions collision resistant?

Assume there are two keyed hash-functions $H_1(k_1, m)$ and $H_2(k_2, m)$, with $k_1$ and $k_2$ being independently randomly sampled public keys. The XOR-combiner is defined as $C_\oplus^{H_1, H_2}:=...
Kristian Koenig's user avatar
3 votes
0 answers
111 views

Are there "light" versions of cryptographic hash functions?

After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
Ryan B.'s user avatar
  • 153
3 votes
0 answers
146 views

Is WPA2 collision-proof?

I was experimenting with hashcat and aircrack to test WiFi security. The WiFi AP is a WPA2 encrypted network. The tool I used to ...
Kristi's user avatar
  • 31
3 votes
0 answers
146 views

Cracking $f(x) = Cx \oplus Dx$

A program I reverse engineered is using $f(x) = Cx \oplus Dx$ where C = 0x20ef138e415 and D = 0xd3eafc3af14600 as a hash ...
Alex James's user avatar
3 votes
0 answers
123 views

Impossible to construct collision resistant hash function from one way function

[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where ...
satya's user avatar
  • 1,404
3 votes
0 answers
1k views

Question about modifying the MD5 plain text to cause a collision

I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ...
chettyharish's user avatar
3 votes
1 answer
347 views

Collision finding method

The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
Kuba Chrabański's user avatar
2 votes
0 answers
103 views

Security of Even-Mansour based Merkle-Damgård

Assuming I have single-key Even-Mansour with single $2n$-bit permutation in wide-pipe Merkle-Damgård specifically with Matyas-Meyer-Oseas mode outputting $n$-bit hash. What security can I expect ...
LightBit's user avatar
  • 1,649
2 votes
0 answers
68 views

Is there any standard extension of the Merkle-Damgård transform that handles arbitrary-length inputs?

I have seen multiple sources claim that the Merkle-Damgård transform is able to build a collision-resistant Hash-function $H$ for arbitrary-length inputs from a compression function $h : \{0,1\}^n \to ...
Steven's user avatar
  • 131
2 votes
0 answers
127 views

Why this function isn't second preimage resistant?

Why is $h(k,m)$ not second-preimage resistant? Let $E_k$ be a block cipher where the message space is the same as the key space. $$h(k,m)=E_k(m\oplus k)\oplus k$$ I've been reading about second ...
Emma's user avatar
  • 21
2 votes
1 answer
469 views

Is this modification in Merkle-Damgård collision-resistant?

We modify Merkle-Damgård construction by setting $z_0:=L$ (the length of the message), computing $z_i:=h(z_{i-1}||x_i)$ for $i=1,...,B$ and defining $H(x):=z_B.$ Is this construction collision-...
user84987's user avatar
2 votes
0 answers
122 views

Estimating the Security of SIS-Based Signature, by verifiying a subset of coordinates?

As I understood, the GPV signature scheme works as follows: KeyGen($1^n$) : Generate a Lattice with public $A \in Z_q^{n.m}$ and a secret trapdoor $t$. Sign $m$: compute $\vec y = H(m) \in Z_q^n$ ...
abdul rahman taleb's user avatar
2 votes
0 answers
219 views

Does there exist a highly irreversible hash function or a highly irreversible pseudo-random number generator?

In my previous question, I asked about potential symmetric cryptosystems which are designed to be computed by a reversible computer. I am now wondering if there are any cryptographic hash functions ...
Joseph Van Name's user avatar
2 votes
0 answers
405 views

Hash function for sets with efficient membership testing

Is it possible to construct a collision-resistant function that hashes a set of values but also allows membership testing? Essentially, I'm looking for a pair of functions, $\text{H} : \{0,1\}^{**} \...
Tim McLean's user avatar
  • 2,824
1 vote
0 answers
29 views

Grow-only set homomorphic hash function from semigroup?

I have been exploring Bellare and Micciancio's "randomize-then-combine" paradigm for deriving set homomorphic hashing functions. I am particularly interested in grow-only sets, such that ...
Carson Farmer's user avatar
1 vote
0 answers
68 views

Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
1 vote
0 answers
67 views

How to estimate the collision resistance of a hash function if a secondary key is used (keyed hash function)?

According to the documentation of HighwayHash, for finding a collision are expected $m \over 2$ guesses, being $m$ the message. By contrast, 'strong' hashes such as SipHash or HighwayHash require ...
alpominth's user avatar
  • 391
1 vote
0 answers
87 views

What is the proof that the RSA is collision-free?

We have the RSA function: $c = m^e (mod n)$. I would like to know the proof that there is not an $m_1$ and an $m_2$ message that produce the same $c$. My thoughts: We know that $m \le n$, so $m_1 \...
Jakab Martin's user avatar
1 vote
0 answers
40 views

Checksum algorithm using system of multivariate polynomials

I'm working on a protocol that uses zero-knowledge proofs. I'm looking at systems of polynomial equations as cheap solutions for checksumming data. Note, I'm not looking for trapdoor functionality ...
vimwitch's user avatar
  • 139
1 vote
0 answers
125 views

Hash function collision resistance

I have a course work for university, and am not sure on my answer so if anyone could please take the time out to read the question and my answer to let me know if I'm going in the right direction that ...
hasin's user avatar
  • 77
1 vote
0 answers
136 views

Probability of getting a collision using chosen plaintext attacks

For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA. Question: I have attempted to answer part 3, but am not very confident in the ...
hasin's user avatar
  • 77
1 vote
0 answers
30 views

Does a salt by a trusted party remove the need for collision resistance for a binding commitment?

Say a Human is operating their trusted computer, Alice, and Human wants to hand copy a collision resistant commitment, with a security factor of 128 from Bob on to paper. Naturally we want the ...
Nic's user avatar
  • 498
1 vote
0 answers
69 views

Compute a hash function given commitment to some secret element

Given a secret key x and a commitment to it comm(x) where comm(x) is both binding and hiding (it can be for example $g^x$ or some homomorphic encryption). Given public parameters $P_1,...,P_k$, comm(x)...
Doron's user avatar
  • 99
1 vote
0 answers
49 views

What is an advantage of the Charles--Lauter--Goren hash function?

What is an advantage of the Charles--Lauter--Goren hash function (based on isogenies of elliptic curves) among other provably secure collision-resistance hash functions ? I heard that it is slower.
Dimitri Koshelev's user avatar
1 vote
0 answers
72 views

Cryptographic hash function to map interval onto itself

Is there any existing approach to construct perfect hash function that map [0, M) to [0, M)? It should be one to one mapping and ...
Tomilov Anatoliy's user avatar
1 vote
0 answers
87 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
augustus's user avatar
1 vote
0 answers
1k views

How to find the 6 main properties of cryptographic hash functions when implementing a hash function?

According to this there are at least 6 "properties" all cryptographically secure hash functions strive to attain: Deterministic: the same message always results in the same hash; Quick: it ...
Lance's user avatar
  • 171
1 vote
0 answers
68 views

One way function with fixed point

As part of an exercise in a cryptography course, I want to come up with a one way function for which it is "easy" to find a collision from a given OWF. To achieve this, I tried the following:...
yankovs's user avatar
  • 21
1 vote
0 answers
48 views

Hash function producing cycles with expected max length

Is there a known hash function $H_k: X\to X$ such that: $\forall{x\in{X}},\exists{n\in{\mathbb{N}}}, n<k \land H^n(x)=x$ === EDIT === By hash function I mean ...
Marcin Król's user avatar
1 vote
0 answers
107 views

Changing a bit in IV of MD5

It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
abbas's user avatar
  • 165
1 vote
0 answers
96 views

Is there a universal construction for Davies-Meyer hash functions?

My understanding is that there exists no strong pseudorandom permutation for which the Davies-Meyer construction is known to yield a provably collision-resistant hash function. Were I mean provably ...
Keshav Srinivasan's user avatar
1 vote
0 answers
43 views

Help, Feedback and Solutions to a problem on a PoC CSPRNG

Background I do not recommend trying to roll your own crypto. This is just a for-fun PoC, which won't be used in any public or private scenario. I am creating a PoC nearly-true random number ...
Display Name's user avatar
1 vote
0 answers
53 views

Round counts and permutation usage for hashing for a Merkle tree

Are there any current recommendations for performant hashing in a Merkle tree? It appears the hash based signatures in Sphincs use Blake2 everywhere (see Table 1 on page 22 of https://sphincs.cr.yp....
Jeff Burdges's user avatar
  • 1,116
1 vote
0 answers
586 views

Show that the CBC-MAC construction applied to a PRP is not collision resistant

I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it. So far I have spent several ...
Jonathan Harvey's user avatar
1 vote
0 answers
92 views

Extendable hash collision resistance of multiplication

I have a hash function $HashSet(A) = H(a_1) *\cdots * H(a_n)$, where $A = \{a_1,\ldots,a_n\}$ and $H$ is a hash function which generates values of $b$ bits (and $H$ has no collision attack that ...
yeerk's user avatar
  • 111
1 vote
0 answers
198 views

How many times does a hash function have to be evaluated?

I have the following homework assignment: $n$ is an even number, $1^n$ and $0^n$ are $n$-bit strings and $x$, $y$ and $z$ are arbitrary strings of length $n$. How many evaluations of hash ...
Thomas Vanhelden's user avatar
1 vote
0 answers
250 views

TCR hash functions from MD5

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical (pag. 10 and 11) and here say The most direct way to construct a TCR hash function is to key a function like MD5 or SHA-1. ...
juaninf's user avatar
  • 2,671
1 vote
0 answers
48 views

MD Construction Doesn't Propagate TCR

I'm reading a proof of the proposition of CollisionResistant Hashing Towards Making UOWHFs Practical Suppose there exists a compression function $F: \Sigma^k\times\Sigma^{c+m'} \rightarrow \Sigma^...
juaninf's user avatar
  • 2,671
0 votes
0 answers
60 views

What is the fastest 128-bit non-cryptographic hash function?

I need a 128-bit hash function which is extremely fast since it will be used for generating unique IDs for billions of objects. It doesn't need to be a cryptographic hash function nor does it have to ...
TypicalHog's user avatar
0 votes
0 answers
28 views

Calculating maximum plaintexts without birthday collisions given a probability, when the encryption scheme has multiple parts?

I'm sorry if the answer to this is actually simpler than it seems to me. I'm running AES-GCM to encrypt some data keys, but I don't actually know how to go about calculating the probability of ...
RotundChinchilla's user avatar
0 votes
0 answers
165 views

Is the following hash function construction collision resistant?

The problem Let the following function be a collision reisistant hash function $$H=\{H_s:\{0,1\}^{2n} \rightarrow \{0,1\}^{n} \}$$ Let the following function be a PRG $$G:\{0,1\}^{n+1} \rightarrow \{0,...
zBION1C's user avatar
0 votes
0 answers
131 views

Do "superfast" keyed hash functions exist?

A common family of requirements for (cryptographic) keyed hash functions is that the function $h(k,-)$ should have good collision resistance for all keys $k$, even if the key $k$ is known to the ...
SocraticMathTutor's user avatar
0 votes
0 answers
67 views

Having trouble providing a distinguisher proving this hash function is not collision-resistant

As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
HughJass24's user avatar
0 votes
1 answer
73 views

How to understand the argument “if the adversary outputs x then it queries (a, x) to oracle”?

When I read the work of Dodis et al. ref1, it looks as if I have encountered a simple logical bug. (I'm not concerned with the details of secure proof techniques, but with the logic of reasoning.) In ...
Duan's user avatar
  • 1
0 votes
0 answers
436 views

What hashing algorithm is fast and good enough for checking if source data is changed?

Not sure if this falls into crypto from contextual point of view but it is about hashing algorithms. I have two directories -- assets/ and cache/. Anytime there is a file added, deleted, or changed in ...
Gasim's user avatar
  • 113
0 votes
0 answers
106 views

Is there a special limit in the range of the hash function?

Is there a special limit in the range of the hash function? More specifically, is it possible that there is a cryptographic hash function that outputs c-membered subsets of the n-membered set? In ...
ali alizade's user avatar
0 votes
0 answers
61 views

Assumptions used for Designing Homomorphic CRHF

What are the possible assumptions that have been used or can be used for designing the homomorphic Collision Resistant Hash function (CRHF)? I know Short Integer Solution (SIS) is one of the ...
Novice_researcher's user avatar