Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

9
votes
0answers
260 views

how to understand the universal hash and the leftover hash lemma

I always meet the leftover hash lemma when I read some papers.But I only know the defination of universal hash and the leftover hash lemma.How to understand them and how to use them?
8
votes
0answers
437 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...
5
votes
0answers
280 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistal ...
5
votes
0answers
139 views

Efficient proof of knowledge using Wegman-Carter hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
5
votes
0answers
85 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
4
votes
0answers
43 views

Why does FS&K's SHAd-256 construction zero-prefix the inner message?

Ferguson, Schneier and Kohno's Cryptography Engineering §5.4.2 describes a construction, $SHA_d\text-X(m)$, which is just $SHA\text-X(SHA\text-X(0^b\mathbin\|m))$ (where $SHA\text-X$ is any particular ...
4
votes
0answers
251 views

Hash Function Properties

What i am trying to understand is shown in all three properties of secure hash function, i will focus on pre-image resistance. Pre-image resistance: given a hash h, it's difficult to find m s.t. H(m)=...
4
votes
0answers
81 views

linear cryptanalysis of hash function

I have studied linear cryptanalysis for block ciphers, but i did not understand how it works on hash functions. Can you give me an explanation of this attack on hash functions?
4
votes
0answers
80 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
4
votes
0answers
142 views

What is perfect collision-resistence in probability terms?

update: removed lots of stupidity... sorry. I didn't know I can be this stupid but I achieved it. 1. Goal Let $\mathcal{D}$ be the universal space of our plain data. Our goal is to find a function $...
4
votes
0answers
436 views

Are there MD5 collisions for inputs of different length?

There are many examples of MD5 collisions (some of them can be found here Are there two known strings which have the same MD5 hash value?). But as far as I know two inputs should have the same length ...
4
votes
0answers
377 views

Why does HMAC use two different keys?

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use $H(k||...
4
votes
0answers
427 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
4
votes
0answers
305 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
3
votes
0answers
67 views

How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?

Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.
3
votes
0answers
45 views

Ambainis quantum collision-finding alg; triple hash output lengths?

I just stumbled onto a series of 2017 papers about applying the Ambainis quantum collision-finding algorithm to hash functions. (disclaimer: I haven't read all of them in full yet): Post-quantum ...
3
votes
0answers
90 views

Does there exist a highly irreversible hash function or a highly irreversible pseudo-random number generator?

In my previous question, I asked about potential symmetric cryptosystems which are designed to be computed by a reversible computer. I am now wondering if there are any cryptographic hash functions ...
3
votes
0answers
92 views

What is the expected number of different sequences of bits in the collection that contains $2^{800}$ elements?

Let $F$ denote a function that returns the first $800$ bits of the input. Let $G(N)$ denote a function that returns the last $800$ bits of the binary encoding of the given number $N$. For example, ...
3
votes
0answers
67 views

Rabin fingerprint preimage with given length and alphabet

The Rabin fingerprint looks something like this: ...
3
votes
0answers
165 views

How feasible is a preimage attack or speedups to brute force a substring of MD5?

Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four ...
3
votes
0answers
477 views

Calculating probability of finding collisions in an invertible hash function

Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions: Choose a random M as input. Compute its ...
3
votes
0answers
693 views

How to map a handful of numbers in a large range to a much smaller range deterministically without collissions

I want to map a set of long integers (say around 100 different values) that can span the entire 64 bit integer range to a much smaller range such as from 0 to 25000 deterministically with almost zero ...
3
votes
0answers
423 views

Are there any known inverse hash lookups for the zero string?

Just wondering, are there any known inverse hashes / hash lookups in common hashes (md5, sha1, sha2, etc.) for the zero string hash value? (i.e. bytes 0x00 00 00 00 00 ...) Or more specifically, for ...
3
votes
0answers
152 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
3
votes
0answers
103 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
3
votes
0answers
393 views

Prove preimage resistance property

Let $ f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $ g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $ h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I ...
3
votes
0answers
198 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
3
votes
0answers
386 views

Infinite depth BLAKE2b tree hashing

In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] (...
2
votes
0answers
56 views

How to derive a hash function from another hash function?

Problem: I'm trying to figure out how to solve this, apparently it's hashing the hash value itself. So G has two rounds of hashing the original message x. I tried searching for the relationship ...
2
votes
0answers
46 views

Secure hashing when the input comes from a small space

I have a problem that I'll simplify here. Let's say I want to store a table of {person, fav color}. Only, I don't want anyone to ever be able to look up a person't favorite color; the only thing ...
2
votes
0answers
98 views

Is it possible to prevent length extension attacks

Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
2
votes
0answers
35 views

Adding the key in the first state of keyed sponge-based hash function

What are the advantages to add the key in the inner or outer part of first state in keyed sponge hash functions?
2
votes
0answers
47 views

How can I generate a deterministic evenly distributed random number in a blockchain

Here's the hypothetical. There's a blockchain, which for the sake of simplicity, is modelled around Bitcoin and proof-of-work. My goal, is that for each mined block, rather than a set reward (12.5 ...
2
votes
0answers
80 views

Merkle tree to prove integrity of subset of data

I'm thinking up a scheme where a merkle tree is used to ensure integrity of a set of data items, and different parties are allowed to verify the integrity of different subsets of that data. Let's ...
2
votes
0answers
53 views

Combining multiple hash functions for HKDF

I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
2
votes
0answers
87 views

Can a stream cipher with a big S-box create ASIC-resistance?

For a proof of work system a hash algorithm generates one pseudorandom index each round, in the same manner as RC4 and Spritz do. And it uses a bigger S-box, e.g. 2^20 numbers. The actual hash would ...
2
votes
0answers
135 views

Hash function for sets with efficient membership testing

Is it possible to construct a collision-resistant function that hashes a set of values but also allows membership testing? Essentially, I'm looking for a pair of functions, $\text{H} : \{0,1\}^{**} \...
2
votes
0answers
261 views

Optimal way to get checksum digits from hash?

Let msg be some data we want to hash using an arbitrary digest size algorithm such as blake2b. From that hash, we would like to compute a checksum field with n decimal digits. If we suppose that the ...
2
votes
0answers
374 views

Analytically finding magic constant in reversible hash function

The below integer "hash" functions form a pair of reversible hash functions: ...
2
votes
0answers
91 views

Hash function onto a Schnorr group

Let $q$ be a given random prime of $2b$-bit for some security parameter $b$ (say $b=128$); let $p$ be a given much larger random prime with $p=q\cdot r+1$. Let $(G,*)$ be the (Schnorr) subgroup of $\...
2
votes
0answers
127 views

how to verify subset of hashes from hash list

I need to verify a couple hashed (SHA256) integers from a list of approximately 50 hashed integers in a message. The list can be divided into groups. The (plain) integer data is not in the message, ...
2
votes
0answers
134 views

Cyclic group collision resistant keyed cryptographic hash function

I am self-studying cryptography from a book and have come across a really difficult question that's doing my head in. I would be very grateful if somebody can help me out here with this difficult ...
2
votes
0answers
100 views

Signing integers and UUIDs and restoring them from a third party server without tampering

I'm educating myself about cryptography. I know this is a long one, but please, bear with me. :) Now I have a scenario in my mind and I'd like to ask if what I've thought is sound (enough), what more ...
2
votes
0answers
124 views

Discrete logarithms: large prime modulus vs. large semi prime modulus

I have a cryptography homework question, in the question it says a cryptographic hash function in the form of $f(x) = g^x \bmod n$ , where $n$ is a very large prime (1024bits and more), $g$ is a ...
2
votes
0answers
570 views

Bobcat hash, trying to find a 48-bit hash collision for x

I am trying to find a collision with the Bobcat hash of the 48-bit hash. I am a beginner coder so please point out any flaws in my modification of the bobcat program. It does find a truncated 12-bit ...
2
votes
0answers
372 views

SHA3 Keccak, absorbing data to the state

I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: {...
2
votes
0answers
158 views

How does use of HMAC affect hash function combiners?

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)...
2
votes
0answers
899 views

Question about modifying the MD5 plain text to cause a collision

I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ...
2
votes
0answers
202 views

How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
0answers
192 views

Does Keccak have an eTCR mode?

On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3): ...