Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

8
votes
1answer
514 views
+50

Why does HMAC use two different keys?

Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
1
vote
1answer
47 views

Is there any bias whatsoever in modern hash function outputs?

We know that the output bias of a randomness extractor is $ \epsilon = 2^{-(sn-k)/2} $ from What is the relationship between entropy conditioning and final output bias in a TRNG?. The following is a ...
2
votes
2answers
168 views

How difficult is it to guess a salt based on a hash and known plain text?

I have the following use case: Alice owns the domain alice.com and Bob owns bob.com. I want to users to create a hash for ...
2
votes
0answers
29 views

How to ensure integrity of encrypted data having hashes only?

Having: plaintext $P$ a hash function $H$, encryption $E$ with key $k$ $h_p = H(P)$ and $h_{E_P} = H(E_k(P))$ Is there an encryption scheme $E$ or hash algorithm $H$ that allows proving that $h_{...
-1
votes
0answers
19 views
22
votes
2answers
3k views

Is H(k||length||x) a secure MAC construction?

If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mathbin\| x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k \...
2
votes
1answer
48 views

Partial Known Message Pre-Image Attack on SHA-1

If the last 448 bits of a sha1 block input are known (only the first 64 bits are unknown). Is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute force all $...
0
votes
1answer
43 views

Encrypted Database

I'm trying to build a encrypted database where we cant trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, I ...
6
votes
2answers
844 views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
22
votes
3answers
6k views

“Weaknesses” in SHA-256d?

According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so: SHA-256d(x) = SHA-256(SHA-256(x)) Apparently, the motivation for ...
2
votes
1answer
112 views

How to safely derive a value from a secret?

I have a use case of symmetric encryption with a single-use random key K known only by the sender and the receiver: In my scheme, Bob is able to send beforehand a tiny amount of information to Alice. ...
3
votes
3answers
367 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
-1
votes
1answer
38 views

Length extension attack for file download

I am trying to understand the length extension attack. I found this tutorial where the author performs length extension on a file download URL. Original URL: http://example.com/download?file=...
1
vote
1answer
63 views

Is a hashing algorithm considered broken if a collision happens under $2^{n/2}$?

If for example we would find a hash collision for SHA256 with $h(x) = h(x')$ for $x \ne x'$ and $x, \space x' < 128$ bit (meaning both $x$ and $x'$ are smaller than 128 bit), would SHA256 be ...
0
votes
0answers
5 views

How does Argon2id store salts in PHP? [migrated]

The PHP implementation of Argon2id generates a salt for the developer. How does the application keep track of this salt? As a developer, how do I account for backups and otherwise ensuring that I don'...
3
votes
1answer
177 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input?

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
1
vote
2answers
54 views

Integrity check of a binary firmware file with hash function

I need to provide a mechanism that it is possible to verify the integrity of a firmware image flashed on an embedded system. The procedure should be, that if someone has doubt on the firmware’s ...
-1
votes
1answer
51 views

Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...
-1
votes
1answer
71 views

Original papers for hashing functions

I would like to learn how hashing functions are discovered / created. In part of this process I think it would be helpful to see the original works or papers of any authors of cryptographic or non-...
14
votes
2answers
4k views

What is a ratchet?

while reading Whatsapp's Security Whitepaper I found the term "ratchet". What does it mean in cryptography? The Message Key is derived from a sender’s Chain Key that “ratchets” forward with every ...
-1
votes
1answer
43 views

If I hash ABC123, where ABC123 appears five times inside the file, will each of the five instances of ABC123 appear as identical hash values? [closed]

If I hash the word SOUND, where the word SOUND appears five times inside the file, will each of the five instances of SOUND appear as identical hash values?
1
vote
0answers
54 views

Participant workflow in the Cryptography competitions [closed]

I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2. What I'm wondering is what people generally ...
2
votes
2answers
105 views

Does the knowledge of SHA256(secret) and SHA256(secret + known constant) give any information about the secret just SHA256(secret)?

Does knowledge of SHA256(secret) and SHA256(secret + known constant) give any information about the secret than just SHA256(secret)?
5
votes
1answer
137 views

Is the seed block in Argon2 (H0) 64-bit or 64-byte?

Is the H0 block in Argon2 64-bits, or 64-bytes? The RFC says bits: Establish H0 as the 64-bit value as shown below. But then it attempts to generate 64-bytes using Blake2 Background I'm trying ...
79
votes
7answers
103k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
4
votes
2answers
489 views

How can I hash an input into an arbitrary domain point?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
4
votes
1answer
472 views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
1
vote
3answers
113 views

Collusion resistant computing of same function by two servers

Is there a secure way of computing same hash function of replicated data by two servers. I mean that both servers host the same version of replicated data and they should output h(M) without colluding,...
-1
votes
1answer
100 views

How to change hash checksum of a text file without changing the contents in the file

I have created a text file called test.txt and the content of the file is Hello World I would like to change the SHA checksum hash without modifying the contents and filename. Is there any way to do ...
7
votes
2answers
844 views

Using a hash function as a random number generator

Using MD5 or SHA1 for instance, and applying integers (as seed so to speak) to the hash function, in sequence, and only keeping, say, the first 64 bits of the resulting hash, do we always have a ...
3
votes
2answers
235 views

What do the security definitions of SHA-3 mean, quantitatively?

In the SHA-3 standard (page 31) the security of SHA-3 is defined quantitatively, for example, they are saying SHA3-256 provides 256 bits of preimage resistance. How is this number of bits to be ...
5
votes
1answer
102 views

Partial collisions of hashes, why is this important?

There's a lot of work finding "partial collisions" in hashes, and "Parallel Collision Search with Cryptanalytic Applications" seems to be the go-to paper for this work. I'm trying to understand why ...
2
votes
1answer
1k views

Questions about the argon2 options

So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2. I didn't find anything about them. What exactly does the ...
5
votes
1answer
1k views

Are hash functions strong against quantum cryptography and/or independent enough of mathematics?

I work on ethereum and other blockchain technologies. And seeing that quantum pc's are someday going to see the light I have some questions / doubts. I was wondering if hash functions are strong ...
2
votes
2answers
100 views

SHA-1 collision for strings of two symbols

Is it possible to have strings of two (Unicode) symbols with equal SHA-1 hash? For example, smth like "ab", "ba".
4
votes
2answers
102 views

Why is this MAC flawed?

Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where $m$ is a message provided by Alice, and k is a secret key known only to ...
7
votes
1answer
3k views

How is the message digest related to Signatures and Encryption?

I was studying about 'Data Security' and I found out this one thing confusing. What is a message digest? I got it is the hash of the message. Is the message here referring to the plaintext or cipher ...
2
votes
1answer
51 views

Moni Noar One Way Function: What does input is partioned mean?

I am trying to understand An Implementation of Efficient Pseudo-Random Functions. There, the following hash function is defined: We define $\hat{h}=\hat{h}_{r}: {\{0,1\}}^* \rightarrow {\bf Z}_R$ ...
17
votes
1answer
3k views

What are the consequences of removing a single byte from a sha256 hash?

I'm working on a system (Ethereum) where it is significantly cheaper to store 32 bytes than 33 bytes. I'd like to create a table where data is stored based on its hash. Sha256 would meet this ...
4
votes
1answer
73 views

Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$

This is a homework question, therefore I'm not expecting full solutions, just general guidance. I want to build a one-time MAC using universal hashing. I defined my hash functions as: $h_{a,b}:\...
12
votes
5answers
2k views

Hash to prime numbers?

Is there some provably secure hash function to prime numbers? Say, a function $H: \{0, 1\}^* \rightarrow \{e: e \in \{0, 1\}^\lambda \land e$ is prime$\}$ I'm asking because there are some ...
2
votes
1answer
57 views

Is it possible to guarantee a SHA-256 hash will begin with a certain 3 bytes?

I've found this online currency someone has built as a project and it's "miner" / Proof of Work algorithm is as follows: Generate 32 bytes of random data and hash it, store the original value and the ...
1
vote
0answers
39 views

Is text description of MD2 algorithm wrong?

I'm trying to implement MD2 from scratch of RFC 1319. It feels like there is a gap between steps 3.2 & 3.3. After step 2, the checksum C is appended to the message and never mentioned again. We ...
0
votes
2answers
129 views

Blockchain cryptography

I'm a high school student doing a project about blockchain. I'm trying to figure out why hashing algorithms are crucial for the existence of blockchain and other types of cryptography wouldn't work. ...
2
votes
1answer
76 views

Hashing into a supersingular elliptic curve

Is there any way to hash from a string $\in \{0,1\}^{*}$ into a supersingular elliptic curve $E(F_p)$ such that the hash function behaves(provably) like a random oracle, and is efficient? Using ...
-1
votes
0answers
29 views

How do chat applications encrypt group messages?

This question is about techniques and architecture. Apps as Telegram/WhatsApp offers encryption p2p on messages, but how does it work with groups? Example: One room(chat group) have n users(...
4
votes
1answer
43 views

Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
142
votes
1answer
69k views

What are the differences between a digital signature, a MAC and a hash?

A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed?
8
votes
3answers
1k views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
9
votes
1answer
411 views

Can Whirlpool take advantage of AES-NI?

Whirlpool uses a modified version of the AES / Rijndael algorithm. Can Whirlpool take advantage of AES-NI instructions (or possibly other specialized constructs) on Intel and Intel compatible ...