People who code: we want your input. Take the Survey

Questions tagged [collision-resistance]

Difficulty of finding two different inputs that hash to the same value

Filter by
Sorted by
Tagged with
0
votes
1answer
126 views

The collision rate probability decreases when using compression?

Some standard compression procedures, like the IANA's gzip provided by HTTP protocol, will consume CPU-time anyway... So we can reuse compressed file, $Z(x)$, in the checksum procedure. That is, we ...
1
vote
2answers
1k views

Does the double-hash H(H(x)) have greater collision probability than H(x)?

Let $H$ be a collision resistant hash function and $P_c[H](S)$ the collision probability about a sample set $S$ of input elements (eg. random numbers). It increases with double hash? That is, $P_c[H\...
1
vote
1answer
125 views

Is exponentiation of a fixed generator modulo a prime collision-resistant?

Let $p$ be a prime number, and $g$ a generator of $\mathbb Z/p\mathbb Z$. For a message $m$, define the hash function $$h(m) = g^m \pmod p.$$ Is $h$ collision-resistant?
1
vote
1answer
373 views

Is there a deterministic one-way collision-free crypto algorithm?

I use usernames encrypted using a function f as ids of records. Users see records identified by f(username). I must not know real usernames. I want to be protected from attack when adversary who has ...
0
votes
1answer
318 views

6 Byte for HMAC in wireless system secure?

A wireless system has 8 byte payload and 6 byte for message authentication. Scheme: ...
0
votes
2answers
196 views

Security of password hash with known prefix and appendix

Assume I have a password that is exactly 32 characters long. I hash it the following way: Prepend 1524 bytes (known to an attacker) Append 3356 bytes (known to an attacker) Do the checksum It is ...
1
vote
1answer
220 views

Randomized public-key encryption as binding commitment / “collision-resistance”?

I am looking to use randomized public-key encryption in a context where it should also serve as a sort of "binding commitment". That is, I want to encrypt a value $x$ with some randomness $rnd$ under ...
36
votes
4answers
40k views

How can hashes be unique if they are limited in number? [duplicate]

I'm curious, how can for example SHA-256 be unique if there are only a limited number of them?! For clarification: how many MD5 hashes are there? $16^{32}$ MD5 hashes can be produced. $16^{64}$ SHA-...
6
votes
1answer
820 views

Is there a way one can combine two correlated hash outputs to maximize the collision resistance?

While practically diving into collision resistance, I am trying to first write a non-cryptographic hash (to learn from it) which is limited to arithmetic operations on 32-bit integers only. It ...
3
votes
1answer
93 views

Security implications of slow-by-design hashes on relative security vs. hash size

Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design? Example: let's say you want 128-bit hashes. This is ...
4
votes
1answer
689 views

How can I determine if a hash function is secure?

I'm doing an exam in computer security and I encountered this problem which I'm unsure of how to attack properly. Should I get down and dirty with the Hash function on paper or is there a more general ...
1
vote
1answer
201 views

Dynamic Length Hash Function?

Sorry if this is elementary, but is there such a thing as a dynamic length (output) hash function? Something that would be a fast way to calculate hashes and output different lengths of strings for ...
1
vote
1answer
135 views

Backward Expansion of SHA1

Given a SHA1 hash, is it now possible to "practically" find the source material that was passed through SHA1 now that the Shattered paper has produced the first "practical" collision? As a follow on ...
2
votes
1answer
367 views

Why do you need padding block at the end of Merkle damgard if the input is multiple of block length?

Why do you need padding block at the end of Merkle Damgard if the input is multiple of block length? I learned that it was not collision resistant if a dummy block is not added to the end but I want ...
0
votes
1answer
936 views

What is a fast good-uniformity hash function that if it's seed and it's hash values are unknown, can be strong as cryptographic hash functions?

The hash function is for an application that the input to the hash function is from a user's, hence the user can control the collisions, but the question is that if the collisions, the hash function's ...
7
votes
2answers
125 views

Collision-resistance of $H\Bigl(\bigl(H(m_1\mathbin\| 1)\oplus H(m_2\mathbin\|2)\oplus\dots\oplus H(m_n\mathbin\|n)\bigr)\mathbin\|n\Bigr)$?

In this answer and discussion, it is considered a distributable hash $$\tilde H(m)\ =\ H\Bigl(\bigl(H(m_1\mathbin\| 1)\oplus H(m_2\mathbin\|2)\oplus\dots\oplus H(m_n\mathbin\|n)\bigr)\mathbin\|n\Bigr)...
3
votes
2answers
1k views

Is it secure to hash an AES key?

Let's say I want a way of generating a deterministic public ID for a specific symmetric cryptographic key (AES, for example). Would it be secure to use SHA-3 (or SHAKE) to hash the key, and then ...
3
votes
1answer
886 views

Create a CR hash function where truncating one bit leads to collisions

I was reading Boneh and Shoups's A Graduate Course in Applied Cryptography, when I stumbled upon the following exercise (I have changed the array indices to start at 1 instead of 0): 8.1 (...
0
votes
1answer
70 views

Convert a state-dependent hash-based signature scheme into a stateless message-dependent one

Suppose we have an XMSSMT instance that is capable of signing up to 2^60 messages securely when given some state-dependent information, I could envision making it stateless as follow: Hash the ...
1
vote
1answer
127 views

What does the〈 〉notation mean in this situation?

I was looking at solutions for a problem but I noticed it said $\langle2\rangle$ and was unsure of what that meant. From Homework 5 (PDF)
3
votes
1answer
275 views

Strength of Hash obtained by XOR of parts of SHA3

I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail has the last 64 bits. Next, I XOR head and tail. Which ...
2
votes
0answers
149 views

Does there exist a highly irreversible hash function or a highly irreversible pseudo-random number generator?

In my previous question, I asked about potential symmetric cryptosystems which are designed to be computed by a reversible computer. I am now wondering if there are any cryptographic hash functions ...
1
vote
1answer
201 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
1
vote
1answer
916 views

collision and pre-image difference

I'm doing an online free course about cryptography and there's a very confusing question: Can anyone explain the answer please? ...
7
votes
1answer
682 views

Does preimage resistance and/or collision resistance imply the infeasiblility of finding fixed points in hash functions?

For example, if $H$ is a secure cryptographic hash function, is it infeasible to find $x$ such that $H(x)=x$ or such that $H(H(x))=x$ ? What about finding $x, y$, and $z$ such that $H(y||H(z||x))=x$ ?...
4
votes
1answer
628 views

Collision-free one-wayish function mapping 32 bit to 32 bit

As simple as it may sound, I was unable to find a collsion free one-way(ish) function which takes 32 bits of input and produces 32 bits of output. I apologize if I just didn't knew the right keywords ...
1
vote
1answer
264 views

Difficulty of generating a string “The (md5|sha1) hash of this string is (x)” that hashes to (x) vs. regular hash collision between files?

I know that collisions in md5 and sha1 have been demonstrated in particular pairs of files (by incrementing some none viewable portion of a PDF, etc). Would generating the above string be ...
0
votes
1answer
253 views

Why is H(k || m || k) secure against birthday attack?

I don't know if my opinion is correct. I think that H(k || m || k) (I mean using Merkle and Damgard algorithm where k is a secret key shared by two parties and m is the message sent) is a good keyed ...
10
votes
3answers
649 views

Designing a hash function from first principles rather than depending on heuristics

Is there a general method to design a cryptographic hash function (with desired properties) from first principles? That is, is there a general process for constructing such functions? I get the ...
3
votes
1answer
740 views

Difference between second pre-image resistance attack and collision attack

According to my understanding of hashing algorithms -: Collision attack is an attack wherein we have a hash(x) and we try to find hash(y) such that x!=y while hash(x)=hash(y). Second pre-image ...
0
votes
1answer
137 views

The danger of Hash collision in Schnorr NIZK

We use Fiat–Shamir heuristic to turn Schnorr ZK to NIZK. So now NIZK is secure against chosen message attacks in the random oracle model, that is, ideal hash function: every unique query leads to a ...
1
vote
1answer
529 views

Can two different seeds produce the same output from a PRNG?

In general, is it possible that two different seeds produce the same output from a PRNG? I'm not sure how many different types of PRNGs there are and maybe it depends on which one we consider. I know ...
5
votes
1answer
451 views

Can ChaCha be turned into a collision resistant hash function by xoring keystreams?

In his paper about RFSB Bernstein states that the compression function $(m_1,\ m_2,\ m_3,\ ...\ ,\ m_n) \rightarrow c_1[m_1]\ \oplus\ c_2[m_2]\ \oplus c_3[m_3]\ \oplus\ ... \oplus\ c_n[m_n]$ is ...
2
votes
1answer
960 views

Is CRC32 birthday attack independent of input?

I have a configuration table which stores all device of a system and the corresponding serial numbers : ...
2
votes
2answers
105 views

How can we authenticate a public key with limited secure side channel?

I'm looking for a method for 2 peers verifying the authenticity of each other's public key that was transfered over an insecure channel and where the needed secure side channel can only transfer short ...
1
vote
1answer
287 views

Collision resistance of composed hash functions

Consider the following hash function $H^{1\circ2}(x)=H^1(H^2(x))$ I have been asked to prove that if $H^1$ is CR, $H^{1\circ2}$ will not generally itself be CR. I am assuming $H^2$ is not CR, this ...
5
votes
3answers
1k views

Is a PRF always collision resistant?

Context: We usually assume that the hash functions we use in practice are both: collision resistant and pseudorandom. I wonder what's the relation between those properties. Question: Is a pseudo ...
0
votes
1answer
88 views

Why can an arbitrary compression function mapping $\{0,1\}^{m+2^m} \rightarrow \{0,1\}^m$ not seriously be considered collision resistant?

I recently got a question that I’ld like to share here, since answers might be useful (or at least interesting) for people diving into Merkle-Damgård hash constructions for the first time. We know ...
0
votes
1answer
303 views

Is triple-CRC-32 a bad (or not) idea for generating a uniform distribution hash? [closed]

I have an input of 288 bits (comprising 4 × 32-bit and 10 × 16-bit integers). I need to hash this to 96 bits with as few collisions as possible. I'm aware that CRC is a bijective hash, thus ensuring ...
1
vote
3answers
433 views

Would this hash functionality fall under pre-image resistance or collision resistance?

I understand that there are three main security requirements for hash functions, pre-image resistance, second pre-image resistance and collision resistance. I need to write about a hash function that ...
1
vote
2answers
102 views

Merkle–Damgård padded block concatenated outside the compression function hash?

I learned that the output of hash function from Merkle Damgard is H(x) = ZB+1 = h(ZB || L) = h(ZB - 1 || XB || L) where XB = block of padded x and L = XB+1 and ...
3
votes
1answer
925 views

Winternitz One time signature security

There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$ Security of both is as following $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...
1
vote
1answer
116 views

Minimum difference collision metric

Take a hash function $H$. There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$. Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or ...
4
votes
2answers
796 views

Collision resistance in a hash function

I'm confused about whether the following hash function is collision resistant. $x \sqsubseteq y $ denotes that x is equal to y or x precedes y. $ H:\{0, 1\}^* \rightarrow \{0, 1\}^n$ If $x \...
1
vote
1answer
130 views

Figuring out seed/internal state from HMAC-MD5 output

Here is the scenario i'm imagining, I use the python random library to generate x-bit key that I use to generate a HMAC-MD5 output. Every HMAC-MD5 has uses a different random number as its key. My ...
11
votes
1answer
956 views

Collision resistance of hash function built on modular exponentiation

Consider the following hash function family for hashing integers: $Gen(1^k)$: generate 2 $k$-bit primes p,q. Let $n = pq$. Choose random $y \rightarrow QR_n$ and output $n,y$. $H_{(n,y)}(x) = y^x \...
1
vote
1answer
1k views

Getting the key used for HMAC given the hash and the plaintext?

I'm working on a little exercise to understand the drawbacks of poor library choices and I've been presented with the following scenario. The HMAC function in python is being used (md5). I know the ...
6
votes
1answer
2k views

Is it possible to make two files with the same size and the same MD5 and CRC32?

I have seen a lot of different files with the same MD5s. For CRC32 is quite easy to find collision. But is is it possible to make size, and two different hashes the same? I have seen many linux ...
6
votes
2answers
741 views

Purpose of hashing last block in Merkle-Damgård?

Is hashing the last block in the Merkle-Damgård necessary in preventing collisions? i.e. What if I just outputted $z_B || L$, where $z_i$ is the hash of the last block of the message, L is the length ...
14
votes
1answer
11k views

Are there any well-known examples of SHA-256 collisions?

The popularity of SHA-256 as a hashing algorithm, along with the fact that it has 2256 buckets to choose from leads me to believe that collisions do exist but are quite rare. Are there any well-...

1
3 4
5
6 7
12