Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

318 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11 votes
0 answers
687 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistel ...
user avatar
9 votes
0 answers
2k views

Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
Habib's user avatar
  • 951
9 votes
0 answers
672 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...
user794034's user avatar
7 votes
0 answers
200 views

Who invented salt, and why is it called salt?

I'm looking for an authoritative reference about the history of salts in the context of hash functions. Why is the personalization string in a hash function called a "salt"? Who should be ...
Mikero's user avatar
  • 13.1k
7 votes
1 answer
473 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
Nonam's user avatar
  • 71
6 votes
0 answers
566 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
David Szalai's user avatar
5 votes
0 answers
605 views

How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
user2284570's user avatar
5 votes
0 answers
74 views

Security implications of using the low-order bits for Merkle–Damgård message length

According to RFC 1321 § 3.2 (MD5), the length of the message ($b$) is encoded as $b \bmod 2^{64}$: ...
forest's user avatar
  • 15.2k
5 votes
0 answers
190 views

Efficient proof of knowledge using Carter-Wegman hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
fgrieu's user avatar
  • 140k
5 votes
0 answers
573 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
SDL's user avatar
  • 1,867
5 votes
0 answers
115 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
Chad Brewbaker's user avatar
4 votes
0 answers
178 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
Ryan's user avatar
  • 141
4 votes
0 answers
141 views

Is the XOR-combiner of independent keyed hash-functions collision resistant?

Assume there are two keyed hash-functions $H_1(k_1, m)$ and $H_2(k_2, m)$, with $k_1$ and $k_2$ being independently randomly sampled public keys. The XOR-combiner is defined as $C_\oplus^{H_1, H_2}:=...
Kristian Koenig's user avatar
4 votes
0 answers
282 views

Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
kira-wulfstan's user avatar
4 votes
0 answers
269 views

Second preimage attack complexity when the digest is malleable

An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. ...
forest's user avatar
  • 15.2k
4 votes
0 answers
451 views

Hash Function Properties

What I am trying to understand is shown in all three properties of a secure hash function, I will focus on Preimage attack resistance. Preimage resistance: given a hash h, it's difficult to find m s.t....
Antonis Paragas's user avatar
4 votes
0 answers
108 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
Elias's user avatar
  • 4,903
4 votes
0 answers
138 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
torrho's user avatar
  • 189
3 votes
0 answers
34 views

Data type transformation in Rust library

I am using some ark libraries, such as ark_ff and ark_bls12_381, to implement some cryptographic algorithms. In these algorithms, random oracles are needed, which gets some group elements in G1,G2,Gt ...
Walker's user avatar
  • 61
3 votes
0 answers
111 views

Are there "light" versions of cryptographic hash functions?

After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
Ryan B.'s user avatar
  • 153
3 votes
0 answers
69 views

Proof of Lemma 1 paper " Provably Secure Partially Blind Signatures Masayuki ABE and Tatsuaki OKAMOTO"

I'm troubled by a system of equations presented in the paper "Provably Secure Partially Blind Signatures" Masayuki ABE and Tatsuaki OKAMOTO. In lemma 1 the authors define $t_2=w_j-c_i$ ...
Panos's user avatar
  • 41
3 votes
0 answers
148 views

Is WPA2 collision-proof?

I was experimenting with hashcat and aircrack to test WiFi security. The WiFi AP is a WPA2 encrypted network. The tool I used to ...
Kristi's user avatar
  • 31
3 votes
0 answers
130 views

Building 256-hash function from 128-bit hash function

After reading this topic: How do I construct a 256-bit hash function from 128-bit AES? It looks like it can be done. If we have 128-bit into 128-bit secure mapping, indistinguishable from random (but ...
Tom's user avatar
  • 1,211
3 votes
0 answers
137 views

Can you use a keyed hash function as a general purpose hash function?

I'm working with SWIFFT, a provably secure keyed hash function, which is desirable to me. Unfortunately from what I gather it is ONLY a keyed hash function. Would there be any disadvantages or ...
Steve Mucci's user avatar
3 votes
0 answers
214 views

What is an efficient cryptographic hash function in the λ-calculus?

Most hash functions are designed to be fast in conventional processors, but there are contexts where machine integers either don't exist, or aren't the most efficient option. For example, zk-snark ...
MaiaVictor's user avatar
  • 1,345
3 votes
0 answers
146 views

Cracking $f(x) = Cx \oplus Dx$

A program I reverse engineered is using $f(x) = Cx \oplus Dx$ where C = 0x20ef138e415 and D = 0xd3eafc3af14600 as a hash ...
Alex James's user avatar
3 votes
0 answers
75 views

Approximating multiplication with few instances of $\oplus$, $\ll$, $\land$, $\lor$

In their paper about the AEAD scheme NORX, the authors mention that $a+b$ can be "well approximated" (this is a bit a hand-wavy statement) by $$a+b \; "="\; a\oplus b \oplus ((a\land b) \ll ...
Dominic van der Zypen's user avatar
3 votes
0 answers
76 views

Can the hash of the ciphertext be derived from the hash of the plaintext

Let $C$ be a symmetric cipher $H$ a hash function. Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and ...
Tobias Brandt's user avatar
3 votes
0 answers
286 views

What is the original paper of the length extension attack on hash based MAC functions

A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992; S. Crocker, S....
kelalaka's user avatar
  • 48.3k
3 votes
0 answers
180 views

Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?

HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function. The hash functions considered in that paper were ones based on the Merkle-...
DannyNiu's user avatar
  • 9,080
3 votes
0 answers
191 views

Does varying ChaCha rounds add any security?

This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
Modal Nest's user avatar
  • 1,443
3 votes
0 answers
118 views

Is it impossible to model a homomorphic hash function as a random oracle?

Recall that, by definition, on input a query $q$, a random oracle $H$ can output a fresh random string as its response $H(q)$ (if this query has not been seen before). My understanding. A homomorphic ...
X. G.'s user avatar
  • 424
3 votes
0 answers
1k views

Are there any hash functions that are commutative yet secure for ordered lists?

I'm looking for a hashing function that can combine random numbers together in any order yet still find the same value. But it needs to be secure against hackers. The idea is if I'm hashing together: ...
mczarnek's user avatar
  • 203
3 votes
0 answers
97 views

A "concatenation-like" cryptographic operation that has a fixed output?

I am designing a cryptographic protocol, and I was wondering whether or not there exists a simple cryptographic operation $\diamond$ that is: Associative: $(x\diamond y)\diamond z = x \diamond(y\...
ithisa's user avatar
  • 1,101
3 votes
0 answers
123 views

Impossible to construct collision resistant hash function from one way function

[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where ...
satya's user avatar
  • 1,404
3 votes
0 answers
177 views

How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?

Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.
syed burhan's user avatar
3 votes
0 answers
89 views

Combining multiple hash functions for HKDF

I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
user avatar
3 votes
0 answers
116 views

Can a stream cipher with a big S-box create ASIC-resistance?

For a proof of work system a hash algorithm generates one pseudorandom index each round, in the same manner as RC4 and Spritz do. And it uses a bigger S-box, e.g. 2^20 numbers. The actual hash would ...
user49963's user avatar
3 votes
0 answers
525 views

Optimal way to get checksum digits from hash?

Let msg be some data we want to hash using an arbitrary digest size algorithm such as blake2b. From that hash, we would like to compute a checksum field with n decimal digits. If we suppose that the ...
User314's user avatar
  • 31
3 votes
0 answers
181 views

Hash function onto a Schnorr group

Let $q$ be a given random prime of $2b$-bit for some security parameter $b$ (say $b=128$); let $p$ be a given much larger random prime with $p=q\cdot r+1$. Let $(G,*)$ be the (Schnorr) subgroup of $\...
fgrieu's user avatar
  • 140k
3 votes
0 answers
2k views

How to map a handful of numbers in a large range to a much smaller range deterministically without collissions

I want to map a set of long integers (say around 100 different values) that can span the entire 64 bit integer range to a much smaller range such as from 0 to 25000 deterministically with almost zero ...
user3612009's user avatar
3 votes
0 answers
264 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
jdm's user avatar
  • 131
3 votes
0 answers
207 views

How does use of HMAC affect hash function combiners?

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)...
archie's user avatar
  • 1,988
3 votes
0 answers
647 views

Infinite depth BLAKE2b tree hashing

In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] (...
Stephen Touset's user avatar
3 votes
0 answers
1k views

Question about modifying the MD5 plain text to cause a collision

I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ...
chettyharish's user avatar
3 votes
0 answers
212 views

How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
juaninf's user avatar
  • 2,671
3 votes
1 answer
348 views

Collision finding method

The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
Kuba Chrabański's user avatar
2 votes
0 answers
54 views

Cryptographic accumulator via function composition

I am looking for an alternative to RSA accumulators, and I am wondering if the following option based on function composition might fit the bill. It seems like an obvious tweak on RSA accumulators, ...
Carson Farmer's user avatar
2 votes
0 answers
42 views

Secure mapping functions

I have two secret numbers $A$ and $B$. Both are uniformly-distributed 32-bit numbers. I need a deterministic function $f(x)$ such that $f(A) = B$. $f(x)$ must not leak any information about $A$ or $B$....
zzazzles's user avatar
  • 117
2 votes
0 answers
43 views

Easy-to-update parallelizable hashes

Do any parallelizable cryptographic hash algorithms that allow for quick—preferably constant-time—recalculation of a hash result upon updating a portion of the data input exist? I know that BLAKE3 is ...
Melab's user avatar
  • 3,645

1
2 3 4 5
7