Questions tagged [hash]
A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.
306
questions with no upvoted or accepted answers
11
votes
0
answers
685
views
What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?
Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistel ...
user17887
9
votes
0
answers
2k
views
Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?
There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
- 951
9
votes
0
answers
662
views
LT codes with Homomorphic hashing
I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...
- 91
7
votes
0
answers
146
views
Who invented salt, and why is it called salt?
I'm looking for an authoritative reference about the history of salts in the context of hash functions. Why is the personalization string in a hash function called a "salt"? Who should be ...
- 12k
7
votes
1
answer
454
views
Is there any way to check hash of homomorphic encrypted data?
I need some algorithm that satisfies:
H - hash function
Enc - encryption function (using public key)
M - secret data
$Enc(H(M)) = H(Enc(M))$
Let this system exist: the First person has a secret ...
- 71
6
votes
0
answers
564
views
File Encryption (EFS method)
I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
- 203
5
votes
0
answers
581
views
How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?
Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
- 153
5
votes
0
answers
74
views
Security implications of using the low-order bits for Merkle–Damgård message length
According to RFC 1321 § 3.2 (MD5), the length of the message ($b$) is encoded as $b \bmod 2^{64}$:
...
- 15.1k
5
votes
0
answers
190
views
Efficient proof of knowledge using Carter-Wegman hash
A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
- 138k
5
votes
0
answers
564
views
How hard is a known prefix hash preimage attack on SHA-2?
Suppose the attacker knows $X, Z$ such that
$H(X || Y) = Z$
If bit-length(Y) < 60 then a brute force attack is possible.
What if ...
- 1,867
5
votes
0
answers
115
views
P-Complete hashes, hashing to a larger set
Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits).
Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
- 151
4
votes
0
answers
275
views
Uniqueness and Schnorr signatures
I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
4
votes
0
answers
266
views
Second preimage attack complexity when the digest is malleable
An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. ...
- 15.1k
4
votes
0
answers
451
views
Hash Function Properties
What I am trying to understand is shown in all three properties of a secure hash function, I will focus on Preimage attack resistance.
Preimage resistance: given a hash h, it's difficult to find m s.t....
- 165
4
votes
0
answers
107
views
Which compression functions are MACs?
The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed).
How does this relate to common assumptions for ...
- 4,883
4
votes
0
answers
137
views
Implementation Attacks on Hashes
So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc.
What implementation attacks are there against hashes or hashed based functions (...
- 189
3
votes
0
answers
33
views
Data type transformation in Rust library
I am using some ark libraries, such as ark_ff and ark_bls12_381, to implement some cryptographic algorithms. In these algorithms, random oracles are needed, which gets some group elements in G1,G2,Gt ...
- 61
3
votes
0
answers
110
views
Are there "light" versions of cryptographic hash functions?
After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
- 153
3
votes
0
answers
68
views
Proof of Lemma 1 paper " Provably Secure Partially Blind Signatures Masayuki ABE and Tatsuaki OKAMOTO"
I'm troubled by a system of equations presented in the paper "Provably Secure Partially Blind Signatures" Masayuki ABE and Tatsuaki OKAMOTO.
In lemma 1 the authors define $t_2=w_j-c_i$ ...
- 41
3
votes
0
answers
134
views
Is WPA2 collision-proof?
I was experimenting with hashcat and aircrack to test WiFi security.
The WiFi AP is a WPA2 encrypted network. The tool I used to ...
- 31
3
votes
0
answers
125
views
Building 256-hash function from 128-bit hash function
After reading this topic:
How do I construct a 256-bit hash function from 128-bit AES?
It looks like it can be done. If we have 128-bit into 128-bit secure mapping, indistinguishable from random (but ...
- 1,211
3
votes
0
answers
122
views
Can you use a keyed hash function as a general purpose hash function?
I'm working with SWIFFT, a provably secure keyed hash function, which is desirable to me. Unfortunately from what I gather it is ONLY a keyed hash function. Would there be any disadvantages or ...
- 345
3
votes
0
answers
213
views
What is an efficient cryptographic hash function in the λ-calculus?
Most hash functions are designed to be fast in conventional processors, but there are contexts where machine integers either don't exist, or aren't the most efficient option. For example, zk-snark ...
- 1,335
3
votes
0
answers
146
views
Cracking $f(x) = Cx \oplus Dx$
A program I reverse engineered is using $f(x) = Cx \oplus Dx$ where C = 0x20ef138e415 and D = 0xd3eafc3af14600 as a hash ...
- 31
3
votes
0
answers
75
views
Approximating multiplication with few instances of $\oplus$, $\ll$, $\land$, $\lor$
In their paper about the AEAD scheme NORX, the authors mention that $a+b$ can be "well approximated" (this is a bit a hand-wavy statement) by $$a+b \; "="\; a\oplus b \oplus ((a\land b) \ll ...
3
votes
0
answers
75
views
Can the hash of the ciphertext be derived from the hash of the plaintext
Let $C$ be a symmetric cipher $H$ a hash function.
Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and ...
- 131
3
votes
0
answers
272
views
What is the original paper of the length extension attack on hash based MAC functions
A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992;
S. Crocker, S....
- 47.6k
3
votes
0
answers
173
views
Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?
HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-...
- 9,001
3
votes
0
answers
179
views
Does varying ChaCha rounds add any security?
This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
- 1,443
3
votes
0
answers
112
views
Is it impossible to model a homomorphic hash function as a random oracle?
Recall that, by definition, on input a query $q$, a random oracle $H$ can output a fresh random string as its response $H(q)$ (if this query has not been seen before).
My understanding. A homomorphic ...
- 414
3
votes
0
answers
1k
views
Are there any hash functions that are commutative yet secure for ordered lists?
I'm looking for a hashing function that can combine random numbers together in any order yet still find the same value. But it needs to be secure against hackers.
The idea is if I'm hashing together: ...
- 203
3
votes
0
answers
91
views
A "concatenation-like" cryptographic operation that has a fixed output?
I am designing a cryptographic protocol, and I was wondering whether or not there exists a simple cryptographic operation $\diamond$ that is:
Associative: $(x\diamond y)\diamond z = x \diamond(y\...
- 1,101
3
votes
0
answers
122
views
Impossible to construct collision resistant hash function from one way function
[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where ...
- 1,384
3
votes
0
answers
176
views
How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?
Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.
- 31
3
votes
0
answers
89
views
Combining multiple hash functions for HKDF
I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
user56697
3
votes
0
answers
116
views
Can a stream cipher with a big S-box create ASIC-resistance?
For a proof of work system a hash algorithm generates one pseudorandom index each round, in the same manner as RC4 and Spritz do. And it uses a bigger S-box, e.g. 2^20 numbers. The actual hash would ...
- 31
3
votes
0
answers
517
views
Optimal way to get checksum digits from hash?
Let msg be some data we want to hash using an arbitrary digest size algorithm such as blake2b. From that hash, we would like to compute a checksum field with n decimal digits.
If we suppose that the ...
- 31
3
votes
0
answers
180
views
Hash function onto a Schnorr group
Let $q$ be a given random prime of $2b$-bit for some security parameter $b$ (say $b=128$); let $p$ be a given much larger random prime with $p=q\cdot r+1$. Let $(G,*)$ be the (Schnorr) subgroup of $\...
- 138k
3
votes
0
answers
2k
views
How to map a handful of numbers in a large range to a much smaller range deterministically without collissions
I want to map a set of long integers (say around 100 different values) that can span the entire 64 bit integer range to a much smaller range such as from 0 to 25000 deterministically with almost zero ...
- 131
3
votes
0
answers
263
views
Signature verification with only hash (without full data)
I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
- 131
3
votes
0
answers
207
views
How does use of HMAC affect hash function combiners?
In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions:
$HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)...
- 1,978
3
votes
0
answers
636
views
Infinite depth BLAKE2b tree hashing
In the BLAKE2 paper, the authors define
Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode)
Node depth (1 byte): an integer in [0, 255] (...
- 11k
3
votes
0
answers
1k
views
Question about modifying the MD5 plain text to cause a collision
I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition
The MD5 collision in Problem 25 is said ...
- 203
3
votes
0
answers
212
views
How can I prove that this encryption scheme from a random oracle is secure?
I am reading this example:
A random oracle is an ideal object.
What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
- 2,661
3
votes
1
answer
338
views
Collision finding method
The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
- 199
2
votes
0
answers
29
views
Secure mapping functions
I have two secret numbers $A$ and $B$. Both are uniformly-distributed 32-bit numbers.
I need a deterministic function $f(x)$ such that $f(A) = B$. $f(x)$ must not leak any information about $A$ or $B$....
- 117
2
votes
0
answers
41
views
Easy-to-update parallelizable hashes
Do any parallelizable cryptographic hash algorithms that allow for quick—preferably constant-time—recalculation of a hash result upon updating a portion of the data input exist?
I know that BLAKE3 is ...
- 3,635
2
votes
0
answers
101
views
Security of Even-Mansour based Merkle-Damgård
Assuming I have single-key Even-Mansour with single $2n$-bit permutation in wide-pipe Merkle-Damgård specifically with Matyas-Meyer-Oseas mode outputting $n$-bit hash.
What security can I expect ...
- 1,649
2
votes
1
answer
81
views
Merkle tree alternating hash and polynomial
I want to get feedback on the security of a modified merkle tree data structure. Using the image above as a reference assume I have a random oracle function $H$. Assume $H$ outputs a value in $\mathbb{...
- 139
2
votes
0
answers
66
views
Is there any standard extension of the Merkle-Damgård transform that handles arbitrary-length inputs?
I have seen multiple sources claim that the Merkle-Damgård transform is able to build a collision-resistant Hash-function $H$ for arbitrary-length inputs from a compression function $h : \{0,1\}^n \to ...
- 131