Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

231 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
10
votes
0answers
591 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistel ...
8
votes
0answers
555 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...
6
votes
0answers
526 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
5
votes
0answers
61 views

Security implications of using the low-order bits for Merkle–Damgård message length

According to RFC 1321 § 3.2 (MD5), the length of the message ($b$) is encoded as $b \bmod 2^{64}$: ...
5
votes
0answers
228 views

Second preimage attack complexity when the digest is malleable

An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. ...
5
votes
0answers
179 views

Efficient proof of knowledge using Carter-Wegman hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
5
votes
0answers
106 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
5
votes
1answer
532 views

Hash function as secure as one-time pad?

We know that the one-time pad is provably secure as a cipher to encrypt some data. Is there an algorithm which does the same just as a hash function? Can we get a provably secure hash function? Maybe ...
4
votes
1answer
250 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
4
votes
0answers
425 views

Hash Function Properties

What I am trying to understand is shown in all three properties of a secure hash function, I will focus on Preimage attack resistance. Preimage resistance: given a hash h, it's difficult to find m s.t....
4
votes
0answers
98 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
4
votes
0answers
619 views

Calculating probability of finding collisions in an invertible hash function

Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions: Choose a random M as input. Compute its ...
4
votes
0answers
133 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
4
votes
0answers
410 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
3
votes
1answer
59 views

Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
3
votes
0answers
68 views

Approximating multiplication with few instances of $\oplus$, $\ll$, $\land$, $\lor$

In their paper about the AEAD scheme NORX, the authors mention that $a+b$ can be "well approximated" (this is a bit a hand-wavy statement) by $$a+b \; "="\; a\oplus b \oplus ((a\land b) \ll ...
3
votes
0answers
63 views

Can the hash of the ciphertext be derived from the hash of the plaintext

Let $C$ be a symmetric cipher $H$ a hash function. Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and ...
3
votes
0answers
71 views

Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?

HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function. The hash functions considered in that paper were ones based on the Merkle-...
3
votes
0answers
78 views

Does varying ChaCha rounds add any security?

This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
3
votes
0answers
57 views

Is it impossible to model a homomorphic hash function as a random oracle?

Recall that, by definition, on input a query $q$, a random oracle $H$ can output a fresh random string as its response $H(q)$ (if this query has not been seen before). My understanding. A homomorphic ...
3
votes
0answers
507 views

Are there any hash functions that are commutative yet secure for ordered lists?

I'm looking for a hashing function that can combine random numbers together in any order yet still find the same value. But it needs to be secure against hackers. The idea is if I'm hashing together: ...
3
votes
0answers
57 views

A “concatenation-like” cryptographic operation that has a fixed output?

I am designing a cryptographic protocol, and I was wondering whether or not there exists a simple cryptographic operation $\diamond$ that is: Associative: $(x\diamond y)\diamond z = x \diamond(y\...
3
votes
0answers
92 views

Impossible to construct collision resistant hash function from one way function

[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where ...
3
votes
0answers
165 views

How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?

Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.
3
votes
0answers
81 views

Combining multiple hash functions for HKDF

I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
3
votes
0answers
111 views

Can a stream cipher with a big S-box create ASIC-resistance?

For a proof of work system a hash algorithm generates one pseudorandom index each round, in the same manner as RC4 and Spritz do. And it uses a bigger S-box, e.g. 2^20 numbers. The actual hash would ...
3
votes
0answers
404 views

Optimal way to get checksum digits from hash?

Let msg be some data we want to hash using an arbitrary digest size algorithm such as blake2b. From that hash, we would like to compute a checksum field with n decimal digits. If we suppose that the ...
3
votes
0answers
152 views

Hash function onto a Schnorr group

Let $q$ be a given random prime of $2b$-bit for some security parameter $b$ (say $b=128$); let $p$ be a given much larger random prime with $p=q\cdot r+1$. Let $(G,*)$ be the (Schnorr) subgroup of $\...
3
votes
0answers
1k views

How to map a handful of numbers in a large range to a much smaller range deterministically without collissions

I want to map a set of long integers (say around 100 different values) that can span the entire 64 bit integer range to a much smaller range such as from 0 to 25000 deterministically with almost zero ...
3
votes
0answers
235 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
3
votes
0answers
186 views

How does use of HMAC affect hash function combiners?

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)...
3
votes
0answers
517 views

Infinite depth BLAKE2b tree hashing

In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] (...
2
votes
1answer
58 views

Creating a stronger cryptographic hash given a cryptographic hash

I need a cryptographic hash function that will hopefully be strong even in 50 years. Performance is not an issue. Calculating and verifying can take a huge amount of time if needed. The size of the ...
2
votes
0answers
33 views

Confused about encapsulation using different types of hash functions

I'm reading Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption. In Section 4 there is a description of encapsulation schemes that says We suggest an encapsulation ...
2
votes
1answer
50 views

Rolling Hash function over untrusted data: how to preserve statistical splitting properties?

I would like to know if there is a construction for a Rolling Hash function to be used to split the received untrusted data in chunks. The data is split whenever the hash function drops below a ...
2
votes
0answers
97 views

What is the original paper of the length extension attack on hash based MAC functions

A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992; S. Crocker, S....
2
votes
0answers
48 views

How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?

I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them. For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
2
votes
0answers
183 views

Can I use RSA as hash function?

My end goal is to have an encryption function $e$ and a hash function $H$ such that for all m we have: $$H(e(m)) = e(H(m))$$ This would work if we use RSA encryption along with RSA "hash", ...
2
votes
0answers
85 views

How many bits of cryptographic security do these XOR Mid-Square random numbers have?

This pseudo-random number generator uses only XOR and Mid-Square operations: Get one secret 128-bit truly random seed $R_0$ Generate a million secret $R_j$ by the recurrences (for $1\le j\le 1000000$)...
2
votes
0answers
198 views

Pollard's Kangaroo: How random does $f$ have to be?

I'm implementing Pollard's kangaroo algorithm as described here. Wikipedia's description of the protocol says that you should have "a pseudorandom map $f:G\rightarrow S$." Does anyone know what ...
2
votes
0answers
62 views

Estimating the Security of SIS-Based Signature, by verifiying a subset of coordinates?

As I understood, the GPV signature scheme works as follows: KeyGen($1^n$) : Generate a Lattice with public $A \in Z_q^{n.m}$ and a secret trapdoor $t$. Sign $m$: compute $\vec y = H(m) \in Z_q^n$ ...
2
votes
0answers
32 views

Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
2
votes
0answers
88 views

How to ensure integrity of encrypted data having hashes only?

Having: plaintext $P$ a hash function $H$, encryption $E$ with key $k$ $h_p = H(P)$ and $h_{E_P} = H(E_k(P))$ Is there an encryption scheme $E$ or hash algorithm $H$ that allows proving that $h_{...
2
votes
0answers
555 views

Is it possible to prevent length extension attacks

Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
2
votes
0answers
189 views

Merkle tree to prove integrity of subset of data

I'm thinking up a scheme where a merkle tree is used to ensure integrity of a set of data items, and different parties are allowed to verify the integrity of different subsets of that data. Let's ...
2
votes
0answers
493 views

The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
2
votes
0answers
150 views

Does there exist a highly irreversible hash function or a highly irreversible pseudo-random number generator?

In my previous question, I asked about potential symmetric cryptosystems which are designed to be computed by a reversible computer. I am now wondering if there are any cryptographic hash functions ...
2
votes
0answers
373 views

Homomorphic set hash with membership proof

I'm trying to solve a problem that goes as follow. There is a set of item and that set is very large. Several actors needs to exchange information about this set, such as adding and removing element ...
2
votes
0answers
244 views

Hash function for sets with efficient membership testing

Is it possible to construct a collision-resistant function that hashes a set of values but also allows membership testing? Essentially, I'm looking for a pair of functions, $\text{H} : \{0,1\}^{**} \...
2
votes
0answers
102 views

Rabin fingerprint preimage with given length and alphabet

The Rabin fingerprint looks something like this: ...

1
2 3 4 5