Questions tagged [hash]
A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.
2,878
questions
0
votes
0
answers
3
views
Double Ratchet at Signal: Which impact have the input key and "input" to a KDF-Chain?
At the documentation of the Double Ratchet Algorithm from Signal, at section 2.1 they define the KDF function they use with its properties.
I am referring to the following:
"We define a KDF as a ...
- 31
-1
votes
1
answer
38
views
Finding block mode and key length from encrypted data
I have an AES encrypted data and the key, but I am not able to tell the block cipher mode [ECB|CBC|CTR] used in encryption or know the key length.
Below is the encrypted data output in java.
...
Aviril Smith
0
votes
0
answers
39
views
Hashing a seed full of entropy with a cryptographic hash function and emiting a key with the same size as input: can a collision attack occurs?
I read this in the documentation of HighwayHash:
By contrast, 'strong' hashes such as SipHash or HighwayHash require
infeasible attacker effort to find a hash collision (an expected 2^32
guesses of m ...
- 115
3
votes
1
answer
290
views
One way function candidate based on the Collatz function
I am relatively new to cryptography and am curious what cryptographers would say about what I think is a beautiful one-way hash function described in a paper I found here https://arxiv.org/abs/1801....
- 165
1
vote
1
answer
45
views
Hash Flooding a Randomized Modular Hash Table
Assume we have a hash table using the function h(x) = x mod 32. h(x) = x mod 33. Also assume it dynamically resizes by doubling the amount of buckets and rehashing. If I was able to provide inputs for ...
- 113
4
votes
1
answer
116
views
Cryptographically obfuscating IP addresses while preserving locality
In an online community, you sometimes have to ban certain IP addresses or even entire IP ranges due to abuse. You may hire moderators to help you with this, but you might not trust them enough to show ...
- 43
1
vote
1
answer
41
views
Is it safe or reasonable to use the key parameter in a cryptographic hash function as a counter?
Not all the cryptographic hash functions have the counter parameter for making messages be different for each counter value. But many accept a key parameter.
Is reasonable to use the key parameter as ...
- 115
1
vote
1
answer
129
views
Does an increase of message size increase the number of guesses to find a collision?
If I hash a 256-bit message and generate an output digest of the same size with a cryptographic hash function then the number of guesses to find a collision is expected to be 2^128.
Does increasing ...
- 115
1
vote
0
answers
38
views
How to estimate the collision resistance of a hash function if a secondary key is used (keyed hash function)?
According to the documentation of HighwayHash, for finding a collision are expected $m \over 2$ guesses, being $m$ the message.
By contrast, 'strong' hashes such as SipHash or HighwayHash require ...
- 115
1
vote
0
answers
36
views
How can knowledge of a secret be compared among untrusted entities?
Lets say entity A sends a secret "token" to anybody that they trust.
The token itself is the proof and its sent equally to everybody and it has or needs to be derived from application ...
- 11
1
vote
1
answer
44
views
Can HKDF be used in place of a cryptographic hash function?
For context, I'm making a non-production grade reference implementation of the balloon hash function using the Web Crypto API. In order to make it less susceptible to certain attacks on common memory ...
- 425
0
votes
0
answers
21
views
Once a secure hash function built up a (fast) internal hash table, can data to be hashed be different from the data inserted when doing the lookups?
One experienced user of this forum said: "The key is the input of the hash function to build up a fast internal hash table. The key is hashed again to perform the lookup.".
If I hash a data ...
- 115
1
vote
0
answers
70
views
Why do the hash functions tested by SMhasher appear to be exceptionally fast?
In SMhasher, it seems that data (keys) are read one by one sequentialy, and not splited and:
...
- 115
1
vote
1
answer
29
views
best HMACSHA signed JWT secret length
I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret?
If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
- 13
0
votes
0
answers
21
views
Could Diffie-Hellman ciphertext be used as OPRF(Oblivious pseudorandom functions) input?
In my recent PSI project, I wanted to use Diffie-Hellman encryption to obtain ciphertext as OPRF input, but I could not find similar work related to it.
In my opinion, Diffie-Hellman ciphertext length ...
- 11
0
votes
1
answer
58
views
Logic Flaw, why cant you use randomness to seed more randomness?
If I have 256 bits of handwavium "perfectly random data" and I hash this 256 bits of data with a secure hash function (possibly sha256) could the resulting hash be considered "perfectly ...
1
vote
1
answer
41
views
Why hashing a seed to generate a key and using chaining to get the rest of key matterial is not secure?
Here, an user says about using a seed to generate a key that is larger than the digest size:
"Do not use hash chaining: that's a bad way of constructing a key derivation function from a hash. If ...
- 115
2
votes
2
answers
1k
views
Wouldn't concatenating the result of two different hashing algorithms defeat all collisions? [duplicate]
Let's say I have three messages: A B C
And I run each of these through two different ...
- 963
1
vote
1
answer
49
views
modified Merkle-Damgard construction that does not include message length
How to give an example for collision in modified Mekle-Damgard construction that does not include input length, with two message that ARE multiple of the block length? (Assume the resulting hash ...
- 61
3
votes
0
answers
55
views
Proof of Lemma 1 paper " Provably Secure Partially Blind Signatures Masayuki ABE and Tatsuaki OKAMOTO"
I'm troubled by a system of equations presented in the paper "Provably Secure Partially Blind Signatures" Masayuki ABE and Tatsuaki OKAMOTO.
In lemma 1 the authors define $t_2=w_j-c_i$ ...
- 41
3
votes
1
answer
59
views
UOWHF vs CRHF / Relevance of UOWHF
What's the difference between UOWHF and CRHF and why are UOWHF useful?
As far as I understand, Universal One-Way Hash Functions are an alternative to CRHF. While for CRHF it is hard, given randomly ...
- 93
0
votes
0
answers
19
views
Digital Signature Algorithm(DSA) without hashing the message? [duplicate]
I am learning about various digital signatures and came across DSA. In DSA, the $s$ part of the signature has a hash of the message $H(m)$. I was wondering, why can't we just use the message $m$ ...
1
vote
1
answer
30
views
Data fingerprint using multiple multilinear polynomials
Related to this question. I'm trying to find a way to use this fingerprint system without a second pre-image attack.
Assume I have a set of elements $V = [v_0, v_1, v_2]$ in $\mathbb{F}_p$. Assume the ...
- 47
2
votes
0
answers
43
views
Is there any standard extension of the Merkle-Damgård transform that handles arbitrary-length inputs?
I have seen multiple sources claim that the Merkle-Damgård transform is able to build a collision-resistant Hash-function $H$ for arbitrary-length inputs from a compression function $h : \{0,1\}^n \to ...
- 131
28
votes
4
answers
6k
views
Is there a hash function that's more expensive for an attacker than for the server?
Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate ...
- 425
0
votes
0
answers
20
views
finding the Key if hmac output, and input are known [duplicate]
Assume we have message M, key K, and MAC = hmac-256SHA(M, K).
I wonder if an attacker can figure out the Key K if the attacker knows the Message M and MAC
- 1
2
votes
4
answers
194
views
Is finding an encryption (or hash) algorithm science, or is it art? [closed]
I'm not into cryptography, but I read a bit about it.
I wonder:
AFAIK all encryption (decryption) and hashing routines are built using some very primitive functions (let's name them "atoms" ...
- 161
1
vote
1
answer
25
views
Privacy preserving transformation between hashes
I think this question is related to this other question, but somewhat different.
Let there be a hidden datum $D$ that we observe using a hash function $H_1$, $h_1 = H_1(D)$. There's another hashed ...
- 113
3
votes
2
answers
153
views
is SHA512 with 256 bit set is similar or same as SHA256?
I'm new in Cryptography, if i will use SHA512, but only with 256 bits, is it equal or similar to SHA256?
I'm trying to understand if there is a way to use SHA512 as SHA256
- 31
2
votes
0
answers
27
views
Why use different hash personalization for each level of Merkle tree?
For example zcash uses such approach with Pederesen hash which is collision-resistant, but not preimage-resistant. I assume that it’s used to ensure that we can’t reuse hash from one level which ...
- 21
1
vote
1
answer
79
views
Will a bloom filter produce false negatives if it becomes full?
Does the "no false negative" property hold if a bloom filter becomes full?
I tried playing with this interactive example but it only gives the false positive probability.
- 27
0
votes
0
answers
23
views
Can salt and XOF be used to create a symmetric cipher? [duplicate]
I'm new to crypto, and I've got an idea and I want to get some feedback if it's even a right direction. Let's say that I create a symmetric cipher by using an XOF with a salt and a secret key.
...
- 101
2
votes
1
answer
61
views
How do the c-bits (capacity bits) make the sponge construction better?
I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
2
votes
0
answers
97
views
How to implement hash functions $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ and $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$?
I would like to implement a hash function $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and second fonction $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$ where $k$ is a security ...
- 21
1
vote
2
answers
56
views
Derive related universally unique identifier (UUID) from a main UUID
Given a list of base entities (B) with each of them having a universally unique identifier (UUID) of 128 bits.
I want to attach to them a list of ≤ 7 related entities (TE, UE, ..., ZE) with each of ...
- 433
1
vote
1
answer
121
views
Probability of a collision in the sum of hashed 64-bit values
I'm working on a problem where I need to track some state that's 64-bit integers. It turns out this state can tracked by simply accumulating a sum of differences, which in my case turns out to ...
- 175
3
votes
1
answer
425
views
What is "one-time signature"
I'm studying the post-quantum cryptography (PQC).
While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
- 31
6
votes
3
answers
1k
views
Does symmetric key cryptography usually include hash function?
This may be a very basic question.
I know that symmetric key algorithms use the same key to encrypt and decrypt plaintext and ciphertext.
However, it seems that hash functions are often classified as ...
- 183
0
votes
1
answer
43
views
Correlation between IV value and the output of a hash function
As we know, the IV and the output of SHA-256 are identical in size. Suppose the input value to the SHA-256 is completely transparent. Is there any correlation between IV value and output? Is it ...
- 165
0
votes
1
answer
48
views
Replace checksum with asymetric hash
The purpose is for a server to ensure the content of the flash memory of a slave IoT contains a good known firmware.
The server does not have a copy of the IoT firmware code - but only a hash or ...
- 1
5
votes
2
answers
478
views
Does using multiple hashes (to check if a file has been spoofed) reduce collisions?
I'm trying to create a script that will take a snapshot of the contents of a directory. For each file, all possible metadata will be recorded and written to the database. The point is that with some ...
- 51
2
votes
1
answer
56
views
Free-start collision vs Semi-free-start collision
Recently, I am very interested in the hash function attack paper, so I am reading it closely.
I found out that there are Free-start and Semi-free-start settings among the attacks on the hash function.
...
- 183
2
votes
1
answer
33
views
FORS and DFORS Few time signature Security level
I was reading the FORS and DFORS Few-Time-Signature scheme. I understood the security of HORS Few time signature equals to $ (rk/t)^k $, but I could not understand the security of FORS is $ (r/t)^k $ ...
- 23
1
vote
0
answers
49
views
Effcient collision attack for the Davies-Meyer compression function [closed]
We have a block cipher $E:\{0,1\}^{128}\times\{0,1\}^{128}\rightarrow\{0,1\}^{128}$.
We know that the PRP advantage of E is Adv$_E^{PRP}=t/2^{128}$ where $t$ is the time needed by the algorithm to get ...
2
votes
3
answers
232
views
Is exposing hash of private key provably secure?
Let's say we have an IND-CPA secure public key encryption scheme $\Pi = (\text{Gen}, \text{Enc}, \text{Dec})$. Construct a new PKE $\Pi' = (\text{Gen}', \text{Enc}', \text{Dec}')$ that behaves exactly ...
5
votes
4
answers
262
views
Sending password to server vs. sending SHA
This is an existing website with approx. 100K accounts, and passwords are hashed using bcrypt with a high number of rounds.
The current design that I'm questioning is that we're sending the username ...
- 85
4
votes
1
answer
71
views
Can I get a Merkle proof out of blake3?
The overview of Blake3 states that Blake3 is internally a Merkle tree. Diving a bit deeper into the paper one finds out that Blake3 splits its input in chunks of 1 KiB (1024 B), organizing chunks in a ...
- 1,365
1
vote
1
answer
200
views
Data fingerprint using polynomial and Schwartz-Zippel Lemma
I'm working on a protocol and am looking for a way to fingerprint a set of elements. All elements are evenly distributed across a finite field that is integers modulus $2^{256}$.
Assume I have a set ...
- 47
1
vote
1
answer
55
views
How were the initial values for the chaining variables in MD5 determined?
The original description of the MD5 algorithm initializes the values of A, B, C, and D to the following:
...
- 11
0
votes
0
answers
39
views
Best progress on pre-image attacks?
What is the best progress (i.e. most bits) in crafting messages with a chosen hash image for modern hash functions?
Blockchain networks with proof of work are basically brute force machines for pre-...
- 161