Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
161
votes
1answer
78k views

What are the differences between a digital signature, a MAC and a hash?

A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed?
133
votes
6answers
58k views

Why can't we reverse hashes?

First off, I know hashes are 1 way. There are an infinite number of inputs that can result in the same hash output. Why can't we take a hash and convert it to an equivalent string that can be hashed ...
108
votes
5answers
88k views

Can you help me understand what a cryptographic “salt” is?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a ...
94
votes
2answers
16k views

What is the new attack on SHA-1 “SHAttered” and how does it work?

There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details. My question is: How? How does the ...
89
votes
7answers
124k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
85
votes
4answers
11k views

Has SHA256 been broken by Treadwell Stanton DuPont?

In a recent press release issued by Treadwell Stanton DuPont, the claim is made that their research laboratories have successfully broken all 64 rounds of the SHA256 hashing algorithm. They further ...
84
votes
8answers
11k views

Guarding against cryptanalytic breakthroughs: combining multiple hash functions

Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
59
votes
4answers
44k views

SHA512 faster than SHA256?

I'm getting this strange result that SHA512 is around 50% faster than SHA256. I'm using .net's SHA512Managed and SHA256Managed ...
54
votes
3answers
9k views

Hashing or encrypting twice to increase security?

Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared-...
52
votes
2answers
15k views

What makes a hash function good for password hashing?

Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
50
votes
2answers
16k views

Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?

I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word '...
50
votes
2answers
21k views

“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?

In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm? Similarly, what is the security difference ...
49
votes
2answers
13k views

Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?

If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$? However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
48
votes
11answers
16k views

How do hashes really ensure uniqueness?

This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup. So hashes are said ...
47
votes
2answers
34k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
45
votes
2answers
10k views

Why is SHA-1 considered broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no, then how can SHA-1 be considered broken?
45
votes
1answer
6k views

What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
45
votes
7answers
24k views

Is there a simple hash function that one can compute without a computer?

I am looking for a hash function that is computable by hand (in reasonable time). The function should be at least a little bit secure: There should be no trivial way to find a collision (by hand). For ...
42
votes
7answers
585 views

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

When I say similar, I'm referring to the Hamming distance, the Levenshtein distance, or a similar string distance metric that measures how similar or dissimilar two strings are. For instance, are ...
41
votes
2answers
25k views

Understanding the length extension attack

I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
41
votes
4answers
13k views

Cryptography algorithms that take longer to solve on a GPU than a CPU

I know that Graphics cards are faster at solving algorithms like SHA-256 because of the many builtin processors, but are there Algorithms that take actually longer on a Graphics card than on a modern ...
40
votes
3answers
37k views

Why hash the message before signing it with RSA?

The diagram below illustrates the process of digitally signing a message with RSA: As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
40
votes
2answers
10k views

What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?

Wikipedia lists the following pseudocode for HMAC: ...
38
votes
2answers
18k views

What is the difference between a digest and a hash function?

I was wondering about the difference between these two terms... What is the difference between a digest and a hash function?
37
votes
1answer
2k views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
36
votes
2answers
25k views

Are there any known collisions for the SHA (1 & 2) family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
36
votes
1answer
26k views

RIPEMD versus SHA-x, what are the main pros and cons?

RIPEMD is a family of cryptographic hash functions, meaning it competes for roughly the same uses as MD5, SHA-1 & SHA-256 do. The Wikipedia page for RIPEMD seems to have some nice things to say ...
36
votes
1answer
25k views

Password hashing security of argon2 versus bcrypt/PBKDF2?

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
34
votes
3answers
28k views

What are preimage resistance and collision resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
33
votes
4answers
6k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
31
votes
4answers
5k views

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
31
votes
1answer
21k views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = \operatorname{hash}...
31
votes
1answer
3k views

Proof for the SHA3 claim that 256 bit security is “post-quantum sufficient”?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → {25,50,100,200,400,800,...
31
votes
1answer
9k views

Why use argon2i or argon2d if argon2id exists?

So I am currently working on a GitHub project of mine and I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is ...
31
votes
1answer
85k views

How is SHA1 different from MD5?

On the surface, SHA1 and MD5 look pretty similar. Their diagrams include chunks of bits, bit rotation, xor and special functions. Their implementations are roughly the same length (at least the ones I'...
30
votes
4answers
22k views

How can hashes be unique if they are limited in number? [duplicate]

I'm curious, how can for example SHA-256 be unique if there are only a limited number of them?! For clarification: how many MD5 hashes are there? $16^{32}$ MD5 hashes can be produced. $16^{64}$ SHA-...
30
votes
6answers
3k views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
29
votes
5answers
7k views

Other than password hashes, are there other uses for non-reversible crypto

Hashing is useful for checking that an input matches expectations without giving away the stored expected version - so confirming passwords etc. But are there other use cases? In general, ...
28
votes
11answers
6k views

Why can't I reverse a hash to a possible input?

I'm going to provide “proof” why a hash function can be reversed, and I hope you can tell my why I'm wrong So, a hash function can be implemented as a series of logic gates. All logic gates can be ...
28
votes
3answers
20k views

What is the difference between a HMAC and a hash of data?

On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data. What exactly is the difference between an HMAC and a hash of a ...
28
votes
2answers
10k views

Is HMAC-DRBG or Hash-DRBG stronger?

Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90A (i.e. based on hash functions), which one is cryptographically stronger? Hash-DRBG (Section 10.1.1) HMAC-...
28
votes
2answers
3k views

Is every output of a hash function possible?

Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? In other words, are hash ...
27
votes
5answers
8k views

Is it bad to expose the public key?

I am studying about blockchain and have been focusing on encryption protocols that allow authentication. The digital signature of public and private key seems solid, I have focused on the algorithm ...
27
votes
4answers
33k views

What is the recommended replacement for MD5?

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
27
votes
1answer
1k views

Is it possible to actually verify a “sponge function” security claim?

When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
26
votes
8answers
9k views

Is there really no use for MD5 anymore?

I read an article about password schemes that makes two seemingly conflicting claims: MD5 is broken; it’s too slow to use as a general purpose hash; etc The problem is that MD5 is fast I know ...
26
votes
2answers
39k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough to ...
26
votes
3answers
4k views

Are common cryptographic hashes bijective when hashing a single block of the same size as the output?

It's been said that CRC-64 is bijective for a 64-bit block. It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3? For example, would SHA-512 be ...
26
votes
1answer
5k views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
25
votes
2answers
12k views

How secure is SHA1? What are the chances of a real exploit?

I read that, in February 2017, a SHA1 collision was calculated for the first time. This, and earlier theoretical proof, means that SHA1 is officially cryptographicaly insecure. But, when using SHA1 in ...