Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0 votes
0 answers
66 views

hashing two inputs with a single encryption

I'm looking at hash function constructions that use ciphers. There are many which are analyzed in this paper: https://www.cs.ucdavis.edu/~rogaway/papers/hash.pdf but all of them assume that only a ...
David 天宇 Wong's user avatar
1 vote
1 answer
162 views

Hash Output Distribution for Partly Randomised Input

For a good (unkeyed) hash function, if a part of the input is random, is it fair to assume that the output will also be randomised? More specifically, suppose $H$ has an $n$-bit output, and we write ...
Arghya Bhattacharjee's user avatar
5 votes
0 answers
455 views

Public one-way bijection [duplicate]

What methods do we know to construct a function $f:D\to D$ with domain $D=[0,n)\cap\mathbb N$ (thus $n\in\mathbb N$ elements); demonstrably surjective (thus bijective since $D$ is finite); with ...
fgrieu's user avatar
  • 140k
1 vote
2 answers
136 views

Name for number of output values a hash function can produce?

Any hash function has fixed output size but it does not mean that all values of output values are ever used. What's the term for the size of output set? As an aside: Can it be calculated? How do most ...
Euri Pinhollow's user avatar
1 vote
3 answers
108 views

Is the composition of a hash function with a block cipher collision resistant?

Assume $H$ is a collision resistant and preimage resistant (unkeyed) hash function and $E(k,y)$ is a block cipher where $k$ is the key. I am interested into the collision resistance of the composed ...
Morz's user avatar
  • 11
1 vote
1 answer
102 views

Find two hard to reverse functions f and h such that f ∘ h ∘ g = h (f and h injective, no constraints on g)

I am looking from 3 functions $f,g,h$ from $\mathbb N \to \mathbb N$ (they can be bijections, they need to be injective at least), such that: $$f \circ h \circ g = h $$ and $f$ is hard to reverse ...
Mathematical_Noob's user avatar
14 votes
5 answers
9k views

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

My friend in the software industry came to me with one of his "dumb boss" war stories. This particular time, his (non-technical but eager to learn) manager came to him and told him to, in ...
squinged's user avatar
  • 143
0 votes
0 answers
36 views

Analyzing Insertion Behavior in a Randomized Hash Table

The following problem of my is from final exam for my online course last year; I couldn't have the time to do it, so I want to check whether my answer is correct; Q5) Given an (entirely) random hash ...
Jaclyn's user avatar
  • 1
0 votes
0 answers
53 views

Secure time based one time password over SMS

I am designing a one time password system, in which I will send the password to the user over some transport (concretely SMS). Once they receive it they will type it into the mobile app. In this way ...
jacksmith's user avatar
0 votes
0 answers
80 views

Algorithm attack on an hash attack (Python)

Here is an attempt at a Python implementation of what is described in the paper I attached as an image. The algorithm is too slow or there is something wrong with the code. Any ideas! ...
surimaji's user avatar
3 votes
1 answer
114 views

Does the length extension attack apply to KDFs?

Older hash functions like SHA-256 and SHA-512 are vulnerable to the length extension attack, which is problematic in the context of a MAC. There are several ways to prevent this: Use a newer hash ...
samuel-lucas6's user avatar
1 vote
1 answer
137 views

Differences between two RSA signatures using OpenSSL

I want to sign a file called data.txt and store its signature in data.txt.sig. To create the signature, I want to use an ...
Allgaeuer's user avatar
  • 123
1 vote
0 answers
29 views

Grow-only set homomorphic hash function from semigroup?

I have been exploring Bellare and Micciancio's "randomize-then-combine" paradigm for deriving set homomorphic hashing functions. I am particularly interested in grow-only sets, such that ...
Carson Farmer's user avatar
2 votes
0 answers
52 views

Cryptographic accumulator via function composition

I am looking for an alternative to RSA accumulators, and I am wondering if the following option based on function composition might fit the bill. It seems like an obvious tweak on RSA accumulators, ...
Carson Farmer's user avatar
4 votes
0 answers
177 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
Ryan's user avatar
  • 141
1 vote
1 answer
75 views

Security of this MAC scheme

I'm studying for a cryptography exam, I have this question from a past exam: Consider the MAC with key $k$, based on a block cipher $E_{(k)}$ with block size $n$, and a collision-resistant hash ...
cantrell11's user avatar
2 votes
1 answer
151 views

Random oracle vs implementations like hash function

In this answer, it is stated It has actually been shown (by Canetti, Goldreich and Halevi) that random oracles cannot exist "in all generality" in the following sense: it is possible to ...
user1936752's user avatar
4 votes
0 answers
140 views

Is the XOR-combiner of independent keyed hash-functions collision resistant?

Assume there are two keyed hash-functions $H_1(k_1, m)$ and $H_2(k_2, m)$, with $k_1$ and $k_2$ being independently randomly sampled public keys. The XOR-combiner is defined as $C_\oplus^{H_1, H_2}:=...
Kristian Koenig's user avatar
2 votes
1 answer
774 views

What is the advantage of using hash function families instead of a single hash function?

My guess would be that families are more secure. In which way though? I have seen claims that hash function families can be collision resistant while single hash functions can not be. Is this true? ...
Wouter's user avatar
  • 21
4 votes
2 answers
495 views

Citation to original paper by Davies-Meyer on one way compression functions

I see a lot of references to the Davies-Meyer construction for one-way compression functions. But I can't find any citation to the original paper. Does anyone have it?
Bert's user avatar
  • 41
0 votes
1 answer
175 views

How good is blake3 compared to a random oracle?

How good is blake3 for generating pseudo-random bitstrings in comparison to a random oracle? Let's say we generated an arbitrarily long pseudo-random bitstring by concatenating blake3 hashes together ...
TypicalHog's user avatar
1 vote
1 answer
69 views

Hashing to the target group of bilinear pairing

Assuming we have fixed pairing friendly elliptic curve groups $G_1$, $G_2$ and $G_T$ where for $a \in G_1$ and $b \in G_T$ it holds $e(a,b) \in G_T$. Let's put some more context and we are working in ...
curious's user avatar
  • 6,150
0 votes
1 answer
44 views

Long term Stream Cipher cipher text with MAC storage

Let's say I have x bytes of data that needs to be encrypted with Stream Ciphers such as AES256-CTR, ChaCha20, Salsa20, XChaCha20, XSalsa20. I would like to ask, since these ciphers typically requires ...
Hern's user avatar
  • 159
3 votes
2 answers
753 views

How much entropy is lost due to collision?

If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
Daniel Ghattas's user avatar
1 vote
0 answers
68 views

Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
Mr Alihoseiny's user avatar
0 votes
0 answers
63 views

How to prove that signature hash is wrong without reveal message

Let's say we have Bob, Alice and third party. Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice Alice receive message and decrypt ...
byXrom's user avatar
  • 3
0 votes
0 answers
30 views

How to anonymously poll for information in a small group of people?

A company wants to poll employees about their view of the company (by using a web system, say). They would like to do it anonymously, but they don't want people filling out forms more than once. An ...
user1145880's user avatar
1 vote
1 answer
56 views

Is KangarooTwelve hash function suitable for generating very large key material as Shake-256 is?

If I take a large truly random portion of data, I know that I can generate a 2048-bits key with it (assuming the random data has more entropy than the key). I read in this forum that Shake-256 has ...
alpominth's user avatar
  • 391
2 votes
0 answers
42 views

Secure mapping functions

I have two secret numbers $A$ and $B$. Both are uniformly-distributed 32-bit numbers. I need a deterministic function $f(x)$ such that $f(A) = B$. $f(x)$ must not leak any information about $A$ or $B$....
zzazzles's user avatar
  • 117
-1 votes
1 answer
110 views

Is it possible to deduce the input of a hash by running in reverse? [duplicate]

If i understand correctly, hashes run a defined set of operations iteratively until the original data is all hashed. Can you take a hash value, run it backward through the last step (or once, for an ...
Zekchelovek's user avatar
0 votes
0 answers
130 views

Do "superfast" keyed hash functions exist?

A common family of requirements for (cryptographic) keyed hash functions is that the function $h(k,-)$ should have good collision resistance for all keys $k$, even if the key $k$ is known to the ...
SocraticMathTutor's user avatar
3 votes
4 answers
183 views

What's the name of the property of ideal cryptographic hash functions that effectively make it a random number generator?

Wikipedia says that, for an ideal cryptographic hash function, "the probability of a particular n-bit output result [...] for a random input string [...] is $2^{-n}$ (as for any good hash), so ...
user1145880's user avatar
0 votes
0 answers
70 views

BLAKE2s finding a hash collision [duplicate]

I want to find a hash collision for Blake2 with 32 bit digest length such that i have 2 messages that produce an identical hash digest. How would you do that? is there another option than just ...
Guestlian's user avatar
3 votes
1 answer
397 views

SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS

By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256 i.e. SHAKE256_256(M) = SHAKE256(M,256) What is the motivation of choosing SHAKE256_256 ...
user's user avatar
  • 163
1 vote
1 answer
100 views

Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
Neev Penkar's user avatar
0 votes
1 answer
36 views

Proof of work for large amount of data

I'm new to cryptography, sorry if this question is dumb. I've just read the paper of Dwork and Naor Pricing via Processing or Combatting Junk Mail and understand the example of squaring on $\mathbb{Z}/...
Ta Thanh Dinh's user avatar
0 votes
0 answers
68 views

Is a reduced character space pre-image attack possible for SHA-1?

Given a hash cipher f(sha1($pepper . $plaintext)) where f is some transformation to an 11-byte string pepper is 24 bytes long with a character space of 62 (and is ...
Carmina Martin's user avatar
0 votes
0 answers
81 views

How is Blowfish not reversible when it contains the salt in the hash? [duplicate]

I'm learning PHP and I've come to the password hashing section of a course I'm following, but it's not explained well enough for my liking. It seems that when using the crypt function, and using the ...
cameron6's user avatar
1 vote
1 answer
111 views

Hash-Then-Encrypt or Encrypt-Then-Hash on Keyed Hash Functions

I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-...
Hero's user avatar
  • 11
1 vote
1 answer
115 views

Proof of non membership in a Verkle Tree?

According to the author of the original paper[1], Verkle Trees basically let you save space (typically bandwidth, which can be expensive) by replacing a secure hash with a vector commitment scheme, ...
afm's user avatar
  • 111
0 votes
1 answer
80 views

Does sending encrypted hash inside message compromise security

This might sound like a naive question (And maybe it is (It's an early morning Saturday thought, so there might be some clarity of thought missing)). Suppose we havea protocol that sends messages as ...
Tresorb's user avatar
1 vote
1 answer
68 views

Equality between encrypted hash of data and hash of encrypted data?

Are there any cryptographically strong hash function and encryption function(s) where hash(encryptA(data)) == encryptB(hash(data)). The functions ...
fadedbee's user avatar
  • 916
0 votes
0 answers
67 views

Having trouble providing a distinguisher proving this hash function is not collision-resistant

As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
HughJass24's user avatar
1 vote
1 answer
97 views

Finding two inputs [i, j] of a custom Hash function where their Hashes are [H(i), H(j)] = [H(i), H(i)^2] [closed]

I came upon the following hash function (pseudo-code): ...
bd55's user avatar
  • 33
7 votes
0 answers
189 views

Who invented salt, and why is it called salt?

I'm looking for an authoritative reference about the history of salts in the context of hash functions. Why is the personalization string in a hash function called a "salt"? Who should be ...
Mikero's user avatar
  • 12.5k
1 vote
0 answers
101 views

Zero Knowledge Proof for SHA-256 preimages [duplicate]

I need to design some protocol where actors will leverage Zero Knowledge Proofs (ZKP) to prove that they know the pre-image of some specific SHA256 hash without revealing the pre-image itself. Ideally,...
Bernardo Rodrigues's user avatar
2 votes
1 answer
129 views

SHAKE256 XOF: Absorb incrementally vs all at once

I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher. I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
Rui 's user avatar
  • 31
0 votes
0 answers
33 views

Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge

Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings: secret = H( H( random_string1 ) || H( random_string2 ) ) Let's assume that the adversary ...
Kadir Korkmaz's user avatar
0 votes
1 answer
72 views

KangarooTwelve based Random-Access PRNG

Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
Ilan's user avatar
  • 1
0 votes
1 answer
205 views

using XOR as a hash function

I'm writing a simple small IP hash table on an FPGA for an ARP cache. On the FPGA I need to ensure I can very efficiently calculate the hash due the critical path of the circuit. I have a 32-bit input ...
John Smith's user avatar

1
2 3 4 5
60