Questions tagged [hash]
A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.
618
questions
15
votes
2
answers
6k
views
How reassuring is 64-bit (in)security?
In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
- 9,001
25
votes
1
answer
19k
views
What are the odds of collisions for a hash function with 256-bit output?
There are some related questions on the net but I did not understand their solutions.
I am reading in a textbook about methods of finding a collision. It states to consider a collision for a hash ...
- 397
7
votes
1
answer
3k
views
Multiple AES Key Derivation from a master key
I need cryptography advice regarding this issue.
Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
89
votes
8
answers
13k
views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
- 22.6k
24
votes
4
answers
6k
views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
- 1,505
60
votes
2
answers
20k
views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
- 703
60
votes
2
answers
19k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 703
37
votes
4
answers
10k
views
Why is plain-hash-then-encrypt not a secure MAC?
It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why?
Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
- 1,101
15
votes
2
answers
2k
views
The effect of truncated hash on entropy
Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
- 517
19
votes
4
answers
5k
views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. <...
- 575
32
votes
3
answers
5k
views
Are common cryptographic hashes bijective when hashing a single block of the same size as the output?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3?
For example, would SHA-512 be ...
- 1,867
244
votes
2
answers
139k
views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
- 2,748
25
votes
4
answers
5k
views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
- 139k
16
votes
1
answer
5k
views
Security of KDF1 and KDF2 (hash based KDF's)
It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter:
$K_i = \operatorname{KDF}(K_{master}, i) ...
- 92k
61
votes
3
answers
61k
views
Why hash the message before signing it with RSA?
The diagram below illustrates the process of digitally signing a message with RSA:
As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
- 1,373
24
votes
3
answers
9k
views
Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
I understand the need for padding in MD5 and other hash algorithms such as SHA-1, SHA-256, SHA-384 and SHA-512. But why do we append the message length to the padding? I heard it strengthens the hash ...
- 341
9
votes
1
answer
3k
views
Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256
In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest):
Level I: ...
- 167
148
votes
5
answers
129k
views
What is a cryptographic "salt"?
I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it.
Can I get a ...
- 1,611
60
votes
2
answers
56k
views
Understanding the length extension attack
I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far so that I can convey my understanding of the same and hopefully get ...
user114
22
votes
1
answer
24k
views
What is the maximum size of the plaintext message for RSA OAEP?
OAEP is an important technique used to strengthen RSA. However, using OAEP
(or any technique that adds randomness) reduces the size of plaintexts that can be encrypted.
Assume for instance that OAEP ...
Sarkar
20
votes
2
answers
3k
views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = \mathrm{hash}(k||\mathrm{data})$...
Daniel
13
votes
1
answer
1k
views
Entropy when iterating cryptographic hash functions
Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings:
$$
\DeclareMathOperator{\H}{H}
\DeclareMathOperator{\SHA}{SHA-256}
\H(x) : \left\{0,1\right\}^{n} \mapsto \left\{0,...
- 11k
41
votes
3
answers
49k
views
What are preimage resistance and collision resistance, and how can the lack thereof be exploited?
What is "preimage resistance", and how can the lack thereof be exploited?
How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
- 1,505
26
votes
3
answers
10k
views
"Weaknesses" in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
- 1,378
15
votes
7
answers
5k
views
Is it theoretically possible to construct a string that contains its own hash value?
After saw the xkcd comic Self-Description, I wonder if it is theoretically possible to construct a self-descriptive string that contains its own hash value?
Let's say the string's MD5 value is ...
- 253
128
votes
7
answers
229k
views
Are there two known strings which have the same MD5 hash value?
Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
Adban
34
votes
5
answers
6k
views
What security do Cryptographic Sponges offer against generic quantum attacks?
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:
Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second ...
- 1,430
18
votes
5
answers
10k
views
Is it easy to crack a hashed phone number?
I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
- 297
25
votes
3
answers
5k
views
Proving knowledge of a preimage of a hash without disclosing it?
We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256.
Alice discloses a value $h$...
- 139k
19
votes
1
answer
7k
views
Could we break MD5 entirely in the future?
Even of today MD5 is (sadly) still heavily used in some applications. Even big tools like ApacheMD5. But even today there are more then enough MD5 hashes which are still not cracked.
According to ...
- 4,415
15
votes
1
answer
19k
views
Are hash functions strong against quantum cryptanalysis and/or independent enough of mathematics?
I work on ethereum and other blockchain technologies. And seeing that quantum pc's are someday going to see the light I have some questions / doubts.
I was wondering if hash functions are strong ...
- 325
12
votes
1
answer
2k
views
Why does SHA2-224 use different IV's than SHA2-256?
Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.
- 487
11
votes
1
answer
656
views
How can I instantiate a generalized hash function?
I've come across a bunch of "strange" hash function notations, such as the following ones and now I don't know how to choose / instantiate them.
Can you please explain me what this notation means and ...
- 45.7k
9
votes
1
answer
4k
views
How hard is it to generate a simultaneous MD5 and SHA1 collision?
I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The ...
- 455
6
votes
2
answers
3k
views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
- 47.6k
72
votes
6
answers
62k
views
SHA-512 faster than SHA-256?
I'm getting this strange result that SHA-512 is around 50% faster than SHA-256. I'm using .net's SHA512Managed and SHA256Managed ...
- 1,985
50
votes
2
answers
14k
views
Why is SHA-1 considered broken?
Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)?
If the answer is no, then how can SHA-1 be considered broken?
- 637
46
votes
2
answers
14k
views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
- 617
33
votes
1
answer
8k
views
Should I use the first or last bits from a SHA-256 hash?
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash.
Should I take the first bits or the last bits? Which of them ...
- 433
26
votes
2
answers
7k
views
Is HMAC needed for a SHA-3 based MAC?
HMAC does nested hashing in order to prevent Length Extension Attacks.
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
- 499
17
votes
2
answers
7k
views
Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256
FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks:
it is possible to use an XOF as a hash ...
- 306
14
votes
1
answer
6k
views
Is a second preimage attack on MD5 feasible?
What's the practical status of MD5 w.r.t. second-preimage?
Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
- 139k
13
votes
1
answer
2k
views
Why does HMAC use two different keys?
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?
See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
- 429
10
votes
2
answers
3k
views
Calculation of the avalanche effect coefficient
Given a strict avalanche criterion matrix/dependence matrix for a hash function,how do I calculate the avalanche coefficient for it. I want to calculate a single parameter(value) which represents the ...
- 221
8
votes
3
answers
3k
views
If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
If one were to create a SHA256 hash using 256 coin flips converted to hex (which, as I understand it, is as "entro-phized" as one can capture in SHA256) then take that hash as a string, combine that ...
- 81
6
votes
2
answers
1k
views
Proof that MAC and hash composition is insecure
Let $F$ be a secure PRF and $H$ a universal hash function.
How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$
is an insecure MAC (or an insecure PRF, since a ...
- 447
104
votes
2
answers
20k
views
What is the new attack on SHA-1 "SHAttered" and how does it work?
There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details.
My question is: How?
How does the ...
- 45.7k
35
votes
4
answers
17k
views
Is there a string that's hash is equal to itself?
I was wondering if there's any string that has a hash equal to itself, so that – when using any (none specific) hash function – the hash would be equal to that string?
so that:
...
- 453
9
votes
2
answers
1k
views
Would a HMAC digest make sense in an RSA / ECDSA signature?
When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
- 3,527
173
votes
6
answers
132k
views
Why can't we reverse hashes?
First off, I know hashes are 1 way. There are an infinite number of inputs that can result in the same hash output. Why can't we take a hash and convert it to an equivalent string that can be hashed ...
- 1,847