Questions tagged [hash]
A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.
2,955
questions
1
vote
0
answers
33
views
+50
Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing
I'm working on a project where we have three different software systems—let's call them A, B, and C.
Systems A and B handle user data identified by phone numbers and want to send user actions to ...
9
votes
4
answers
2k
views
+500
Fast cryptographic hash function for short inputs
I am looking for a cryptographic hash function optimized for speed on short inputs, in order to implement a pseudorandom generator with expansion factor 2 (e.g. takes 16 bytes of input and outputs 32 ...
- 19.2k
3
votes
2
answers
642
views
How much entropy is lost due to collision?
If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
- 139k
25
votes
1
answer
19k
views
What are the odds of collisions for a hash function with 256-bit output?
There are some related questions on the net but I did not understand their solutions.
I am reading in a textbook about methods of finding a collision. It states to consider a collision for a hash ...
- 139k
15
votes
2
answers
2k
views
The effect of truncated hash on entropy
Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
- 139k
1
vote
1
answer
96
views
Construction of Blake2 and Cha Cha
Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
CommunityBot
- 1
0
votes
1
answer
76
views
Hash Collision: Weak and Strong Resistance [closed]
On average, against a 128-bit-long key, how many more hash computations would an attacker need to perform to break weak collision resistance compared to breaking strong collision resistance? In other ...
- 47.6k
1
vote
6
answers
1k
views
Is it theoretically possible to create an unbreakable cipher?
I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
25
votes
1
answer
14k
views
When to use Argon2i vs Argon2d vs Argon2id?
I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case.
I want to securely encrypt passwords ...
0
votes
0
answers
50
views
How to prove that signature hash is wrong without reveal message
Let's say we have Bob, Alice and third party.
Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice
Alice receive message and decrypt ...
- 3
0
votes
0
answers
27
views
How to anonymously poll for information in a small group of people?
A company wants to poll employees about their view of the company (by using a web system, say). They would like to do it anonymously, but they don't want people filling out forms more than once. An ...
- 133
2
votes
1
answer
564
views
Is there a simple formula to calculate how many inputs generate same outputs in cryptographic hash functions, being the input larger than the input?
Let's suppose I hash a 384-bits message with a cryptographic hash function and generate a hash digest of 128-bits. I know that due to the pigeonhole principle, many inputs of same size will result in ...
- 21.2k
1
vote
1
answer
85
views
Proof of non membership in a Verkle Tree?
According to the author of the original paper[1],
Verkle Trees basically let you save space (typically bandwidth, which
can be expensive) by replacing a secure hash with a vector commitment
scheme, ...
1
vote
1
answer
50
views
Is KangarooTwelve hash function suitable for generating very large key material as Shake-256 is?
If I take a large truly random portion of data, I know that I can generate a 2048-bits key with it (assuming the random data has more entropy than the key). I read in this forum that Shake-256 has ...
- 92k
3
votes
4
answers
167
views
What's the name of the property of ideal cryptographic hash functions that effectively make it a random number generator?
Wikipedia says that, for an ideal cryptographic hash function, "the probability of a particular n-bit output result [...] for a random input string [...] is $2^{-n}$ (as for any good hash), so ...
- 2,868
2
votes
0
answers
40
views
Secure mapping functions
I have two secret numbers $A$ and $B$. Both are uniformly-distributed 32-bit numbers.
I need a deterministic function $f(x)$ such that $f(A) = B$. $f(x)$ must not leak any information about $A$ or $B$....
- 117
2
votes
1
answer
456
views
Is this modification in Merkle-Damgård collision-resistant?
We modify Merkle-Damgård construction by setting $z_0:=L$ (the length of the message), computing $z_i:=h(z_{i-1}||x_i)$ for $i=1,...,B$ and defining $H(x):=z_B.$ Is this construction collision-...
CommunityBot
- 1
-1
votes
1
answer
92
views
Is it possible to deduce the input of a hash by running in reverse? [duplicate]
If i understand correctly, hashes run a defined set of operations iteratively until the original data is all hashed.
Can you take a hash value, run it backward through the last step (or once, for an ...
20
votes
3
answers
9k
views
Pre-image resistant but not 2nd pre-image resistant?
Are there any cryptographic hash functions for which there is a known pre-image attack, or a known second pre-image attack, but not both?
The attack doesn't have to be practical - just anything that ...
0
votes
0
answers
118
views
Do "superfast" keyed hash functions exist?
A common family of requirements for (cryptographic) keyed hash functions is that the function $h(k,-)$ should have good collision resistance for all keys $k$, even if the key $k$ is known to the ...
3
votes
4
answers
2k
views
What is the best algorithm for compressing a hash?
What is the best way to transform a hash with a longer length into one with a smaller length, preventing as many collisions as possible? (Hashing the hash)
For example: Some versions of Git use SHA-1 ...
CommunityBot
- 1
1
vote
3
answers
152
views
Why cant you use randomness to seed more randomness?
If I have 256 bits of handwavium "perfectly random data" and I hash these 256 bits of data with a secure hash function (possibly SHA-256).
Could the resulting hash be considered "...
- 92k
4
votes
1
answer
501
views
What are the “costs” to find a pre-image, weak collision, or strong collision?
For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
- 47.6k
0
votes
0
answers
70
views
BLAKE2s finding a hash collision [duplicate]
I want to find a hash collision for Blake2 with 32 bit digest length such that i have 2 messages that produce an identical hash digest. How would you do that? is there another option than just ...
- 92k
5
votes
2
answers
1k
views
Different padding rules for Merkle–Damgård and Keccak/sponge function
We learned that length padding was used in Merkle–Damgård where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
- 92k
0
votes
1
answer
79
views
Does sending encrypted hash inside message compromise security
This might sound like a naive question (And maybe it is (It's an early morning Saturday thought, so there might be some clarity of thought missing)).
Suppose we havea protocol that sends messages as ...
CommunityBot
- 1
1
vote
2
answers
230
views
Remote Attestation: when to use Checksum and when to use a Cryptographic Hash function?
In computer security applications, to check the integrity of a specific data/program binary, a cryptographic hash function is normally deployed to generate a digest and compare it with a reference ...
- 1,108
3
votes
1
answer
374
views
SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS
By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256
i.e. SHAKE256_256(M) = SHAKE256(M,256)
What is the motivation of choosing SHAKE256_256 ...
- 47.6k
1
vote
1
answer
95
views
Hash-Then-Encrypt or Encrypt-Then-Hash on Keyed Hash Functions
I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-...
- 11
0
votes
1
answer
35
views
Proof of work for large amount of data
I'm new to cryptography, sorry if this question is dumb.
I've just read the paper of Dwork and Naor Pricing via Processing or Combatting Junk Mail and understand the example of squaring on $\mathbb{Z}/...
- 21.2k
2
votes
1
answer
263
views
Are such verification wormholes known, or even possible?
1. Scenario
Suppose that we have a source that is generating one random value per, say, minute. So we have random value $x_1$ in $1$st minute, $x_2$ in $2$nd minute, $\ldots$, $x_n$ in the $n$th ...
CommunityBot
- 1
0
votes
0
answers
66
views
Is a reduced character space pre-image attack possible for SHA-1?
Given a hash cipher f(sha1($pepper . $plaintext)) where
f is some transformation to an 11-byte string
pepper is 24 bytes long with a character space of 62 (and is ...
0
votes
0
answers
81
views
How is Blowfish not reversible when it contains the salt in the hash? [duplicate]
I'm learning PHP and I've come to the password hashing section of a course I'm following, but it's not explained well enough for my liking.
It seems that when using the crypt function, and using the ...
- 11
8
votes
1
answer
2k
views
Is there a hash tree scheme designed for complex data structures?
I have a JSON object with private data. It has the following (complex!) structure:
...
- 101
2
votes
2
answers
129
views
In sha256, is it possible to use less information than the full preimage to prove that the prefix of the preimage is a certain string
Alice split a long string P into two segments A and B. A is relatively short and B is long.
H = sha256(A + B)
Bob does not know P, but knows H.
Is it possible for ...
0
votes
1
answer
174
views
TLS1.3 transcript hash
From RFC8446:
For concreteness, the transcript hash is always taken from the
following sequence of handshake messages, starting at the first
ClientHello and including only those messages that were ...
CommunityBot
- 1
1
vote
1
answer
487
views
Understanding the HAIFA (hash iterative framework) structure
Unfortunately, this structure doesn't even have a full Wikipedia on it. I'm struggling to understand it. There are no Youtube videos, Lectures, or any educational video on it. I want to understand how ...
- 47.6k
1
vote
2
answers
230
views
Hash coordinates (back-end) without the client (front-end) knowing the coordinates, but to be able to guess them
So I have a set of coordinates and I will hash these with a random salt with SHA256.
Coordinate range is 0,100.
...
CommunityBot
- 1
1
vote
1
answer
68
views
Equality between encrypted hash of data and hash of encrypted data?
Are there any cryptographically strong hash function and encryption function(s) where hash(encryptA(data)) == encryptB(hash(data)). The functions ...
- 47.6k
0
votes
1
answer
64
views
KangarooTwelve based Random-Access PRNG
Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
CommunityBot
- 1
0
votes
0
answers
65
views
Having trouble providing a distinguisher proving this hash function is not collision-resistant
As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
27
votes
6
answers
30k
views
Are there hash algorithms with variable length output?
I understand that for example MD5 produces a 128 bit hash value from a given text of variable size. My question is if there is a hash-like algorithm that will produce a hash value where one can ...
- 45.9k
244
votes
2
answers
139k
views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
- 101
1
vote
1
answer
88
views
Finding two inputs [i, j] of a custom Hash function where their Hashes are [H(i), H(j)] = [H(i), H(i)^2] [closed]
I came upon the following hash function (pseudo-code):
...
- 139k
7
votes
0
answers
148
views
Who invented salt, and why is it called salt?
I'm looking for an authoritative reference about the history of salts in the context of hash functions. Why is the personalization string in a hash function called a "salt"? Who should be ...
- 139k
0
votes
2
answers
106
views
Compression algorithm with multiple valid same-sized outputs
Is there a lossless compression algorithm that has hashing-like properties where there are multiple solutions to it?
As in for example, when a 1000-bit data-sequence is compressed into a 500-bit data ...
CommunityBot
- 1
1
vote
0
answers
100
views
Zero Knowledge Proof for SHA-256 preimages [duplicate]
I need to design some protocol where actors will leverage Zero Knowledge Proofs (ZKP) to prove that they know the pre-image of some specific SHA256 hash without revealing the pre-image itself.
Ideally,...
- 92k
2
votes
1
answer
110
views
SHAKE256 XOF: Absorb incrementally vs all at once
I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher.
I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
- 785
0
votes
0
answers
33
views
Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge
Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings:
secret = H( H( random_string1 ) || H( random_string2 ) )
Let's assume that the adversary ...
1
vote
2
answers
3k
views
Can I update sha-256 digest chunk-wise instead of the whole array at once?
I'm not sure whether this questions is about SHA-256 algorithm itself or the particular implementation I'm using.
Usually, a hash algorithm implementation has functions, let us call them update and ...
- 92k