# Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

1,868 questions
86 views

### Birthday problem applied to hash function with partition of the input set

I am not able to understand why if we consider a regular hash function, it is possible to say that we are partitioning the starting set and then apply the the birthday paradox/problem. Can anyone ...
448 views

### Do very short values make a peppered hash less secure?

Given many very short (or low-entropy) values – like 6-digit numbers – that are stored as hashes using a fixed secret pepper, e.g.: ...
219 views

### Integrity or Confidentiality or Authenticity

If a sender creates a hash H of message M and encrypts it using receiver's public key, what do we ensure of the above three at the receiver's end. PS : I know this is not the right way to send ...
50 views

### Is there a property comparable to IND-CPA for hash functions taking a random value?

I would like to have a function $F(x, rnd)$, where $rnd$ is a fresh random value, such that it is hard, given $x_0$ and $x_1$, to distinguish $F(x_0, rnd)$ from $F(x_1, rnd)$, EDIT: but the values ...
179 views

### Is there a way one can combine two correlated hash outputs to maximize the collision resistance?

While practically diving into collision resistance, I am trying to first write a non-cryptographic hash (to learn from it) which is limited to arithmetic operations on 32-bit integers only. It ...
52 views

### Very difficult hashing function?

I am looking for a very difficult/slow hashing function to hash secrets used to decrypt env files. Because it is used to log when the env files "keys" get recreated I don't need it to be fast, ideally ...
178 views

### The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
148 views

### Can we attack a hash function if we only have the input x such that y = h(x)

This question deals with a "one-way" function $h$. Then, given the value $y = h(x)$, it is computationally infeasible to find $x$ directly from $y$. (a) Suppose that Peter computes $y = h(x)$, ...
62 views

### Security implications of slow-by-design hashes on relative security vs. hash size

Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design? Example: let's say you want 128-bit hashes. This is ...
130 views

### Keyed reversible hash function?

Is there such thing as a keyed reversible hash function? This would be a hash function where computing H(x) is easy and requires no key, but computing x from H(x) is only feasible with the key. Is ...
62 views

### Robust combiner for preimage resistance

My question is about chaining two hash functions to create a robust combiner for preimage resistance. @Zooko already gave a detailed answer here: $$H_{\circ}(x) = H_0(H_1(x))$$ is as strong as ...
42 views

### Hash match vs PGP to ensure integrity

What is the difference? I found it quite hard to check for integrity using Gpg4win. Checking for hash was easy with Online MD5 & SHA1 Hash Generator For File. Is there any advantage to use Gpg4win?...
17 views

### Hash-like Functions [duplicate]

Are there any cryptographically secure hash functions that can be given a array of strings to hash, and will always calculate the same output no matter what order the array elements are in? I realize ...
79 views

### How do I show that the function f is not collision resistant?

Suppose the compression function f is given as below, where B is a block cipher which takes key K and plaintext M and outputs ciphertext C. Show that f is not collision-resistant. I started as ...
154 views

### How can I determine if a hash function is secure?

I'm doing an exam in computer security and I encountered this problem which I'm unsure of how to attack properly. Should I get down and dirty with the Hash function on paper or is there a more general ...
73 views

### Dynamic Length Hash Function?

Sorry if this is elementary, but is there such a thing as a dynamic length (output) hash function? Something that would be a fast way to calculate hashes and output different lengths of strings for ...
126 views

### Safety of having many passwords hashed with the same salt?

I'm working on a web application where passwords must be hashed on the client before it can be send to the server. This is because the user's raw password is used for cryptography purposes and can't ...
138 views

### Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
141 views

86 views

### Backward Expansion of SHA1

Given a SHA1 hash, is it now possible to "practically" find the source material that was passed through SHA1 now that the Shattered paper has produced the first "practical" collision? As a follow on ...
49 views

### Hashing Resource ID Into Publicly Known Value Securely

I am in an environment where I have unique IDs for a list of resources. I am trying to design a system that takes that ID as an input parameter and produces a consistent output for a given resource. I ...
5k views

### Does keyless encryption exist?

Does there exist an encoding/hashing/encryption scheme whereby the original string can always be derived in its entirety given the entire encoded/hashed/encrypted string, and nothing else (no key/...
2k views

### Why does Signal repeatedly hash the secure passphrase?

Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature. In the Signal codebase for their Android app, I noticed that ...
45 views

### Public Key Encryption, how do you handle not trusting the middle man?

With public/private key encryption you must trust the central authority correct? What can you do if you don't want to trust the centeral authority? Are there any ways around that? for example in a ...
749 views

### Can someone explain RSA-PSS to me?

I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated. What I don't ...
74 views

### How to perform Stampery.com's Merkle Proof?

I am using the Stampery API to anchor hashes into different Blockchains. I wanted to independently verify that my hash with the given Merkle Proof from Stampery. I tried to follow their Whitepaper but ...
106 views

### Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
301 views

### Will the ECDSA with SHA-3 implementation be quantum-proof?

I know, that ECDSA could be broken by quantum computers, but since there is post-quantum hash function SHA-3, does not this make the digital signature resistant to them?
54 views

### Proving a Hash in Another Hash

I'm new to cryptography in general, and have this basic question. Provided H(x) means a hash of x and ...
84 views

### What is a fast good-uniformity hash function that if it's seed and it's hash values are unknown, can be strong as cryptographic hash functions?

The hash function is for an application that the input to the hash function is from a user's, hence the user can control the collisions, but the question is that if the collisions, the hash function's ...
99 views

### Collision-resistance of $H\Bigl(\bigl(H(m_1\mathbin\| 1)\oplus H(m_2\mathbin\|2)\oplus\dots\oplus H(m_n\mathbin\|n)\bigr)\mathbin\|n\Bigr)$?

In this answer and discussion, it is considered a distributable hash \tilde H(m)\ =\ H\Bigl(\bigl(H(m_1\mathbin\| 1)\oplus H(m_2\mathbin\|2)\oplus\dots\oplus H(m_n\mathbin\|n)\bigr)\mathbin\|n\Bigr)...
277 views

2k views

### What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
116 views

### Create a CR hash function where truncating one bit leads to collisions

I was reading Boneh and Shoups's A Graduate Course in Applied Cryptography, when I stumbled upon the following exercise (I have changed the array indices to start at 1 instead of 0): 8.1 (...
385 views

### Which algorithm has better performance (HMAC, UMAC, and Poly1305)?

I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So ...
96 views

### How would Keccak-1024

I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that. ...
2k views

### What was the first hash and what problem was it supposed to solve?

Today's hashes have many uses. File integrity, verification of a secret without revealing the secret (i.e. passwords), hash maps, bloom filters, and probably a few more cases not immediately coming to ...
89 views

### Why do we pad the length of the message at the end in Merkle–Damgård constructions? [duplicate]

In a Merkle–Damgård construction we pad the hash of the final block with the length of the actual message. Is this necessary? What happens if prepend the message length instead of appending it? Will ...
111 views

Salts should be unique so that an attacker can't brute force multiple passwords at once. However, since usernames are unique, wouldn't it be possible to use some representation of the username as a ...
3k views

### Why is SHA-3 a Sponge function?

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
130 views

### Strength of Hash obtained by XOR of parts of SHA3

I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail has the last 64 bits. Next, I XOR head and tail. Which ...
85 views

### Is there a variant of Merkle tree with no traceability from root to leaves?

I'd like to store a large amount of objects, all authenticated using something like a Merkle tree. The root will be published, and I'd like to make sure there is no way to enumerate these objects from ...
28 views

### Is it possible to retrive the Hash from an encrypted folder?

So first of all I've a software which basically locks/encrypts a folder with a given password. Afterwards it's almost impossible to open the folder without entering the password through the software. ...
83 views

### Stateless and deterministic number generation

I want a stateless deterministic pseudorandom generator. Following number generation is deterministic, whenever I give $constantValue$, and index it will value $A$ $A = Hash(constantValue + index)$ ...
245 views

### Matyas–Meyer–Oseas for super-fast single-block hash function

Is it basically safe and correct to use the Matyas–Meyer–Oseas construction to turn a fast block cipher like AES into a really fast single block hash function? By single block hash function I mean ...
43 views

### Multikeyed Hash: known algorithms?

A MAC (or HMAC) can be represented by the general formula: MAC = H(key, message) I am calling "Multikeyed Hash" the operation (probably there exists already a ...
53 views

### Does a concatenation of hashes of differently prefixed variations of any chosen message contain all possible finite bitstrings?

Let $A$ denote a sequence of bits. Let $H$ denote a cryptographic hash function that has no limit on the length of its input (for example, SHA-3). Consider the following infinite sequence of ...
90 views

### Does there exist a highly irreversible hash function or a highly irreversible pseudo-random number generator?

In my previous question, I asked about potential symmetric cryptosystems which are designed to be computed by a reversible computer. I am now wondering if there are any cryptographic hash functions ...