Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

0
votes
1answer
25 views

Capital passphrases with rainbow tables?

I'm currently trying to learn how rainbow tables work for a personal project of mine, but I am a little bit confused on how passphrases can be found. Here are the steps that seem do this, from the ...
1
vote
1answer
22 views

Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?

Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?
1
vote
1answer
73 views

Hashing based on the discrete logarithm problem

At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup). Additionally, $H(x)$ ...
0
votes
1answer
33 views

Concept of hashing a group of data and validating if a value exists within the group

When learning about cryptography and hashing, I remember seeing a concept where you could hash a number of values (ID's for example) and then validate against the hash, not storing the original IDs. ...
1
vote
0answers
33 views

Backwards Length Extension Attack

Can SHA 256 be modified to make it vulnerable to length extension attack both by appending text to the front and adding text to the end?
0
votes
1answer
46 views

rotation offsets for KECCAK-$f$[800]

So let's say you're trying to do SHA3-224. If you're on a 64-bit machine you'd presumably use KECCAK-$f$[1600]. In-so-far as I understand it'd have the following parameters: Rate: 448 (2*224) ...
2
votes
0answers
43 views

Is it possible to prevent length extension attacks

Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
-2
votes
1answer
77 views

Cracking MD5, SHA1, SHA256 hashes [closed]

Hey guys i am trying to crack some hashes and it seems to be taking longer then expected (going on 7 days now). I am using John the ripper, I cant use hash cat due to pc limitations. I used online ...
2
votes
1answer
74 views

Why is SHA2 used for file verification if it's susceptible to length extension attacks?

Am I misunderstanding length extension attacks, or is there some different reason, or is it really a bad idea to use SHA2 for file verification? If the answer is that it's really a bad idea, would ...
5
votes
2answers
143 views

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

$\require{begingroup}\begingroup \DeclareMathOperator{\keccak}{\mathrm{Keccak}} \DeclareMathOperator{\concat}{\|} $According to Keccak's website, $\keccak(k \concat x)$ is safe: Unlike SHA-1 and ...
-1
votes
0answers
26 views

ECDHE_ECDSA and TLS Handshake

I am trying to implement TLS protocol and associated ECDSA mechanism on an embedded processor and unable to get a complete grasp of the subject. Most help on the web is limited to a little math behind ...
1
vote
1answer
100 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
1
vote
0answers
38 views

Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that can be verified without knowing M? [duplicate]

Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that, knowing t1, t2, c1, c2, and with no knowledge of M, it can be verified whether both use the same M?
3
votes
2answers
82 views

Validating that a hash is over a specific value for two hashes with additional (known but different) input

$M$ (not public) is hashed with a hash function $\text{H}$ that includes a variable $T_1$ (public), giving $C_1$ (public). The same $M$ (not public) is hashed with the same hash function with another ...
1
vote
0answers
19 views

Signed XML SignatureValue element value (hash in base64) contains &#xd

My application is .NET based. I have signed xml from third-party environment (Java based). Its signature value base64 string contains carriage return #xd;. ...
12
votes
3answers
5k views

What password hash function for the next 50 years?

According to this report : http://www.ecrypt.eu.org/csa/documents/D5.4-FinalAlgKeySizeProt.pdf SHA2-512, SHA3-512, Whirlpool and Blake2b are hash functions that could be safe for the next 50 years. ...
2
votes
1answer
38 views

Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows: ...
1
vote
3answers
121 views

Is there a consensus on what text encoding to use when hashing a string?

Let's suppose we are hashing a string input from the user via keyboard. A string can be interpreted in many different text encodings (ANSI, UTF-8, UTF-16 and many others). Based on what encoding is ...
1
vote
1answer
51 views

Hashing with (some sort of) Public and Private keys/salt/nonce

I'm trying to design a protocol where hashing can involve some public and private components. The idea is that Alice hashes a value with minimal computation and sends the hash to Bob. For Bob it ...
2
votes
1answer
86 views

Right way to hash elliptic curve points into finite field

I would like to know how I can implement several hash functions : $H_1:\{0,1\}^* \rightarrow P $ with $P \in E(\mathbb{F}_q)$ and $H_2:P \rightarrow \mathbb{Z_q}^*$ And others where the ...
1
vote
2answers
72 views

ROT encryption with hash functions

I am not trying to create my own encryption (I am just interested in the math and possibility of this form of "encryption"). I apoligize if this post does not fit in, it is my first time posting. A ...
0
votes
1answer
303 views

How to use cryptography to assure data integrity?

I only understand assurance of integrity using a hash function. How to use cryptograpy to assure data integrity?
4
votes
1answer
197 views

What does ChopMD refer to in the default Go ECDSA package?

If one navigates to the ECDSA Go package page, he can observe that: This implementation derives the nonce from an AES-CTR CSPRNG keyed by ChopMD(256, SHA2-512(priv.D || entropy || hash)) While I ...
0
votes
0answers
57 views

Is this modification of the sponge function cryptographically weaker than the standard sponge function?

Let $\lfloor A \rfloor_B$ denote the first $B$ bits of a bitstring $A$. Let $F$ denote the underlying function of the sponge construction (for SHA-3, $F = \text{Keccak-}f[1600]$ ), assuming that ...
0
votes
0answers
39 views

Anonymized identifier

I'm trying to find an algorithm which would allow me to create anonymized zero-metadata identifiers. I'm creating a system which creates integer identifiers using a counter. Using such identifiers ...
1
vote
1answer
45 views

Can NORX be used as a general purpose hash function?

In general terms, NORX works combining a cryptographic hash function and an stream cipher. At the end of an encryption operation you end with a ciphered message plus its authenticated hash. If you ...
3
votes
2answers
157 views

Why not use ordinary hash functions for password hashing?

Assume we have a password and add a unique salt to prevent various precomputation attacks. Why don't we do this: SHA256(SHA256(SHA256 ...(Password || Salt))) ...
2
votes
0answers
32 views

Adding the key in the first state of keyed sponge-based hash function

What are the advantages to add the key in the inner or outer part of first state in keyed sponge hash functions?
2
votes
3answers
99 views

Two salts, One password

If I have two different MD5 password hashes with two different salts (the salts are known), is there any way to cryptographically deduce if the two passwords match? Other than brute force password ...
3
votes
0answers
56 views

How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?

Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.
2
votes
1answer
49 views

NIZKs for hash functions

Hash functions such as SHA are considered as non-algebraic statements. How can one construct a NIZK proof to show that the output of a hash is computed correctly in an efficient manner.
0
votes
0answers
14 views

JWK vs. raw for key wrapping

Context (TLDR below) So I’m developing an application that uses a high-iteration-count PBKDF2 algorithm to derive a symmetric AES-GCM key from a user-provided (enforced to be reasonably strong) ...
2
votes
0answers
49 views

PRF from hash function?

Let $G=\langle g \rangle$ be a cyclic group of prime order $Q$. Let $H_1:\{0,1\}^*\to G$ be a hash function. Is the following a family of PRF for $s \in \mathbb{Z}_Q^*$? $$f_s(x)=(H_1(x))^s$$ Or ...
1
vote
1answer
53 views

Meaning of $\operatorname{UOWH}(k; u_1, u_2)$

I do not understand the format used in Shoup's "Using Hash Functions as a Hedge against Chosen Ciphertext Attack (page 8 of the PDF) for universal one way hash functions (UOWH). What are $k$, $u_1$ ...
1
vote
2answers
125 views

Best way, how to convert 32-byte Keccak hashes to positive numbers up to maximum?

I have 32-byte Keccak hashes and I have some maximum number, for example 500, how to uniformly convert those hashes to pseudo-random positive numbers up to that ...
3
votes
3answers
104 views

Mechanism to get 10 pseudo-random positive numbers up to maximum from a seed (32-byte hash)?

I have learned new crypto words, so I rewrote the question: I have quite random 32-byte hash which I want to use as a seed for generation of 10 pseudo-random positive numbers up to some maximum ...
-1
votes
1answer
38 views

One-way hashing using singular matrices?

In matrix encoding, we convert our message into some numerical value and then create a matrix out of those numbers. The matrice encryption is based on the fact that a matrix multiplied by its inverse ...
-1
votes
1answer
56 views

How do I convert KECCAK-256 to FLOPS? (Ethereum)

I wanted to know how much one Ethereum KECCAK-256(hash) is in FLOPS. I know bitcoin is 12,697 flops per hash.
1
vote
1answer
63 views

Concatenating hashes

I am thinking about to concatenate two hashes, but I was searched about this and I have questions, if some one should help me. Thank you I have two strings str1 ...
0
votes
2answers
57 views

Can I update sha-256 digest chunk-wise instead of the whole array at once?

I'm not sure whether this questions is about SHA-256 algorithm itself or the particular implementation I'm using. Usually, a hash algorithm implementation has functions, let us call them update and ...
-1
votes
1answer
42 views

Is there any kind of function that has a property like this?

First of all, sorry for any horrible formatting, I have to type this in from my phone. I know (or, at least, I think) that no currently used cryptographically secure hash functions exist with this ...
3
votes
0answers
47 views

Is this a more effective HMAC? [duplicate]

I was given an argument in a conversation today and I don't know how to respond to it: H( k || m || k ) should be a better choice of MAC than the traditional HMAC. The person's rationale was that: "...
3
votes
4answers
88 views

Find some hash function with deliberate collisions

I guess this should be well known (or trivially desperate), but I couldn't find any reference. I have a small number (say $k=15$) of messages $m_i$ ,$i=1\cdots k$ (they are fixed length and short, ...
1
vote
4answers
275 views

Can SHA or MD5 results be decrypted?

I have learned that SHA-1 and MD5 are one way hash functions, which means that it is not possible to obtain the original value by performing the reverse calculation. There however some online ...
2
votes
1answer
59 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
-1
votes
1answer
56 views

Encrypt 2 numbers preserving arithmetic correlation

I want to encrypt 2 numbers using a public key and have the reader know the correlation between those 2 numbers. I can also share the public key. Example: ...
1
vote
3answers
72 views

Authorities on password hashing best practice

I am trying to understand how best practices on password hashing come about. With password hashing, I mean specifically for the case of storing user passwords in a database in a hashed representation, ...
3
votes
2answers
98 views

Generating secure short activation code for offline applications

My application is as follows User has a hardware system (with an unique ID) that does not have connectivity but has a keypad for input. To make the hardware operational, the user has to go to central ...
2
votes
1answer
35 views

How can one build $2^{c/2}$ attack on sponge hash?

Let $H$ be a sponge hash with rate $r$ and capacity $c$, built from a permutation $\pi: \{0, 1\}^n \rightarrow \{0, 1\}^n$, where $n = r + c$. Assuming $r \ge 2c$, how can I find a collision with ...
0
votes
2answers
66 views

Is there any concrete reason to call BLAKE more secure than BLAKE2?

I read a blog article which discussed SHA-3. I noticed it mention that security was often compromised in the name of speed (not always a bad thing, of course). It gave some examples: What I'm ...