Questions tagged [hash]

A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
3 votes
2 answers
629 views

How much entropy is lost due to collision?

If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
Daniel Ghattas's user avatar
0 votes
1 answer
76 views

Hash Collision: Weak and Strong Resistance [closed]

On average, against a 128-bit-long key, how many more hash computations would an attacker need to perform to break weak collision resistance compared to breaking strong collision resistance? In other ...
Tườngg Trần's user avatar
1 vote
0 answers
29 views

Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
Mr Alihoseiny's user avatar
0 votes
0 answers
50 views

How to prove that signature hash is wrong without reveal message

Let's say we have Bob, Alice and third party. Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice Alice receive message and decrypt ...
byXrom's user avatar
  • 3
0 votes
0 answers
27 views

How to anonymously poll for information in a small group of people?

A company wants to poll employees about their view of the company (by using a web system, say). They would like to do it anonymously, but they don't want people filling out forms more than once. An ...
user1145880's user avatar
1 vote
1 answer
50 views

Is KangarooTwelve hash function suitable for generating very large key material as Shake-256 is?

If I take a large truly random portion of data, I know that I can generate a 2048-bits key with it (assuming the random data has more entropy than the key). I read in this forum that Shake-256 has ...
alpominth's user avatar
  • 391
2 votes
0 answers
40 views

Secure mapping functions

I have two secret numbers $A$ and $B$. Both are uniformly-distributed 32-bit numbers. I need a deterministic function $f(x)$ such that $f(A) = B$. $f(x)$ must not leak any information about $A$ or $B$....
zzazzles's user avatar
  • 117
-1 votes
1 answer
92 views

Is it possible to deduce the input of a hash by running in reverse? [duplicate]

If i understand correctly, hashes run a defined set of operations iteratively until the original data is all hashed. Can you take a hash value, run it backward through the last step (or once, for an ...
Zekchelovek's user avatar
0 votes
0 answers
118 views

Do "superfast" keyed hash functions exist?

A common family of requirements for (cryptographic) keyed hash functions is that the function $h(k,-)$ should have good collision resistance for all keys $k$, even if the key $k$ is known to the ...
SocraticMathTutor's user avatar
3 votes
4 answers
167 views

What's the name of the property of ideal cryptographic hash functions that effectively make it a random number generator?

Wikipedia says that, for an ideal cryptographic hash function, "the probability of a particular n-bit output result [...] for a random input string [...] is $2^{-n}$ (as for any good hash), so ...
user1145880's user avatar
0 votes
0 answers
70 views

BLAKE2s finding a hash collision [duplicate]

I want to find a hash collision for Blake2 with 32 bit digest length such that i have 2 messages that produce an identical hash digest. How would you do that? is there another option than just ...
Guestlian's user avatar
3 votes
1 answer
373 views

SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS

By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256 i.e. SHAKE256_256(M) = SHAKE256(M,256) What is the motivation of choosing SHAKE256_256 ...
user's user avatar
  • 153
1 vote
1 answer
96 views

Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
Neev Penkar's user avatar
0 votes
1 answer
35 views

Proof of work for large amount of data

I'm new to cryptography, sorry if this question is dumb. I've just read the paper of Dwork and Naor Pricing via Processing or Combatting Junk Mail and understand the example of squaring on $\mathbb{Z}/...
Ta Thanh Dinh's user avatar
0 votes
0 answers
66 views

Is a reduced character space pre-image attack possible for SHA-1?

Given a hash cipher f(sha1($pepper . $plaintext)) where f is some transformation to an 11-byte string pepper is 24 bytes long with a character space of 62 (and is ...
Carmina Martin's user avatar
0 votes
0 answers
81 views

How is Blowfish not reversible when it contains the salt in the hash? [duplicate]

I'm learning PHP and I've come to the password hashing section of a course I'm following, but it's not explained well enough for my liking. It seems that when using the crypt function, and using the ...
cameron6's user avatar
1 vote
1 answer
95 views

Hash-Then-Encrypt or Encrypt-Then-Hash on Keyed Hash Functions

I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-...
Hero's user avatar
  • 11
1 vote
1 answer
85 views

Proof of non membership in a Verkle Tree?

According to the author of the original paper[1], Verkle Trees basically let you save space (typically bandwidth, which can be expensive) by replacing a secure hash with a vector commitment scheme, ...
afm's user avatar
  • 111
0 votes
1 answer
79 views

Does sending encrypted hash inside message compromise security

This might sound like a naive question (And maybe it is (It's an early morning Saturday thought, so there might be some clarity of thought missing)). Suppose we havea protocol that sends messages as ...
Tresorb's user avatar
1 vote
1 answer
68 views

Equality between encrypted hash of data and hash of encrypted data?

Are there any cryptographically strong hash function and encryption function(s) where hash(encryptA(data)) == encryptB(hash(data)). The functions ...
fadedbee's user avatar
  • 897
0 votes
0 answers
65 views

Having trouble providing a distinguisher proving this hash function is not collision-resistant

As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
HughJass24's user avatar
1 vote
1 answer
88 views

Finding two inputs [i, j] of a custom Hash function where their Hashes are [H(i), H(j)] = [H(i), H(i)^2] [closed]

I came upon the following hash function (pseudo-code): ...
bd55's user avatar
  • 33
7 votes
0 answers
148 views

Who invented salt, and why is it called salt?

I'm looking for an authoritative reference about the history of salts in the context of hash functions. Why is the personalization string in a hash function called a "salt"? Who should be ...
Mikero's user avatar
  • 12k
1 vote
0 answers
100 views

Zero Knowledge Proof for SHA-256 preimages [duplicate]

I need to design some protocol where actors will leverage Zero Knowledge Proofs (ZKP) to prove that they know the pre-image of some specific SHA256 hash without revealing the pre-image itself. Ideally,...
Bernardo Rodrigues's user avatar
2 votes
1 answer
110 views

SHAKE256 XOF: Absorb incrementally vs all at once

I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher. I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
Rui 's user avatar
  • 31
0 votes
0 answers
33 views

Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge

Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings: secret = H( H( random_string1 ) || H( random_string2 ) ) Let's assume that the adversary ...
Kadir Korkmaz's user avatar
0 votes
1 answer
64 views

KangarooTwelve based Random-Access PRNG

Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
Ilan's user avatar
  • 1
0 votes
1 answer
112 views

using XOR as a hash function

I'm writing a simple small IP hash table on an FPGA for an ARP cache. On the FPGA I need to ensure I can very efficiently calculate the hash due the critical path of the circuit. I have a 32-bit input ...
John Smith's user avatar
2 votes
2 answers
1k views

How to generate n unique numbers from the output of a hash function?

What would be an easy way to use the hexadecimal output of a hash function (like md5) to generate n unique numbers from, say 0 to 15. Of course I could generate n ...
Starscream512's user avatar
19 votes
3 answers
13k views

Is it safe to create a public ID by hashing a private key?

In an application, a curve25519 private key is the only stable identifier for an individual. I don't have readily have access to the corresponding public key. Would it be safe to generate a public ...
Moss Richardson's user avatar
0 votes
1 answer
70 views

Safe implicit value validation: $H_k(k \oplus m) \sim H_k(m)$?

$H_k$ is a cryptographic hash function that's keyed using a section of key material $k$ (for whatever definition of "keyed" that's appropriate for the given hash function $H$). Are the ...
aiootp's user avatar
  • 785
2 votes
2 answers
491 views

What is the difference between a seeded RNG and an XOF hash?

Suppose I have some ZK proofs that were turned non-interactive using Fiat-Shamir heuristic. So I need to generate the challenge value deterministically using some data shared between the prover and ...
fjarri's user avatar
  • 289
1 vote
0 answers
60 views

name/acronym/abbreviation explanation for hashes

(Cryptographically and hash/checksum wise consider me a rookie, as I'm rather just using algorithms.) While there are many names, not all of them are explained - I tried searching for the meaning of a ...
AmigoJack's user avatar
  • 111
0 votes
1 answer
47 views

Is there a way to short circuit (speed up) hashing a large but sparse array?

Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
Paul Uszak's user avatar
  • 15.2k
2 votes
1 answer
93 views

Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?

The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
Paul Uszak's user avatar
  • 15.2k
2 votes
1 answer
63 views

Can limited password/PIN length be compensated by a computationally intensive hashing function?

Say we have a very limited password space with only a 4 digit PIN, so only 10000 PIN possibilities. Say also that the attacker has access to the stored form of the PIN. Can breaking the PIN be made ...
hunger's user avatar
  • 123
3 votes
1 answer
60 views

Security level of sponge construction based on output and capacity

I was looking at the security level of instances of sponge construction on Wikipedia depicted in the following image. It seems to me that the security level for collision resistance follows the ...
A.Solei's user avatar
  • 385
1 vote
2 answers
124 views

Sponge construction versus Merkle-Damgard For Hashing based on the very same primitive

I am a bit confused about Sponge construction and Merkle-Damgard-style ones for hashing. The only advantage I see for sponge construction is that they are secure against length extension attacks. So ...
A.Solei's user avatar
  • 385
1 vote
0 answers
32 views

Answering boolean question without knowing "Who" answer [closed]

Can cryptography solve this problem? Two people are chatting, Mr. X and Ms Y. They give each other a CRC16 hash of someone's name initials and salt a random number at the end (suffix). Ms Y: "I ...
Muhammad Ikhwan Perwira's user avatar
0 votes
0 answers
8 views

LoRa Cloud PIN derivation according to 'smtc0' algorithm

I am following the steps in LoRa Cloud in order to derive the PIN value using the Algorithm smtc0 (https://www.loracloud.com/documentation/join_service?url=derivation_schemes.html). I don't quite ...
user110681's user avatar
0 votes
1 answer
89 views

What are the chances of two 5-symbol strings derived from md5 colliding?

I'm taking 2 medium-length strings (50-70 chars) and hash them using md5 to get results like d2ae4f4919a10958e2c603782f0ec1cc, then recording the first 5 symbols of ...
ADC's user avatar
  • 3
2 votes
4 answers
164 views

How is the $\chi$ step of the Keccak permutation invertible?

I would like to understand how Keccak's permutation function is reversible. The difficulty I have is with the $\chi$ step that uses the and operator which is not revertible. All the other ...
glurks's user avatar
  • 23
0 votes
0 answers
44 views

Parallelizable MAC/hash value stored securely

Assume the following: $E: \{0, 1\}^k \times \{0, 1\}^b \rightarrow \{0, 1\}^b$ is a block cipher with a $k$-bit key size and a $b$-bit block size. $T$ is a $b$-bit authentication tag that is ...
Melab's user avatar
  • 3,645
0 votes
0 answers
26 views

tan(x) as a hash function

print(tan(int.from_bytes(open("plain.txt", "rb").read().strip(), "big")).n(1024)) Its sage code. How difficult or easy is it to ...
crypto_lover's user avatar
4 votes
2 answers
119 views

How certain is it that a shorter password can't match the salted hash of a long one?

We (collectively) salt passwords, then hash them; maybe even run them through something like PBKDF2 first (depending on how the password will be used). The end result is that we have a string $p$ and ...
András Korn's user avatar
0 votes
1 answer
87 views

How much of SHA3's internal state can be reached?

After reading that about "37% of the 256-bit outputs" of SHA-256 are unreachable when fed only 256-bit inputs [1] I'm curious & confused. The formula from the proof here considers a ...
aiootp's user avatar
  • 785
1 vote
0 answers
63 views

Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
0 votes
1 answer
89 views

Is keccak256 (and similar hash functions) a suitable KBKDF for 256-bit keys?

Let's temporarily work upon the assumption that proper KBKDF functions do not exist, for the sake of argument. Would keccak256 be a secure choice for a KBKDF that derives 256-bit keys from a 256-bit ...
rrrrrrrrrrrrrrrr's user avatar
2 votes
0 answers
41 views

Easy-to-update parallelizable hashes

Do any parallelizable cryptographic hash algorithms that allow for quick—preferably constant-time—recalculation of a hash result upon updating a portion of the data input exist? I know that BLAKE3 is ...
Melab's user avatar
  • 3,645
0 votes
1 answer
35 views

Is it safe to sign a short token with salted md5

I want to generate some tokens for client as http cookie can I md5 them with salt and then use "<random token>"+"<md5>" as the token ...
xingxing hao's user avatar

1
2 3 4 5
60