Questions tagged [hash]
A cryptographic hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm makes it difficult to find two inputs with the same output or reconstruct the input from the output.
2,955
questions
24
votes
3
answers
9k
views
Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
I understand the need for padding in MD5 and other hash algorithms such as SHA-1, SHA-256, SHA-384 and SHA-512. But why do we append the message length to the padding? I heard it strengthens the hash ...
- 341
0
votes
2
answers
4k
views
How many possible input files are there who's length can be stored in 63-bits?
I'm trying to calculate how many possible combinations of files there can be using a signed 64-bit file length, but can't seem to find a formula (or I'm using the wrong keywords). For example, the ...
30
votes
2
answers
14k
views
Is HMAC-DRBG or Hash-DRBG stronger?
Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90A (i.e. based on hash functions), which one is cryptographically stronger?
Hash-DRBG (Section 10.1.1)
HMAC-...
- 699
3
votes
1
answer
161
views
Is a using salt important when creating a hash data validator?
I am creating a service that will return an set of objects, which will be used by multiple systems. At the end of the process, one (or more) of the objects will be sent back to our system for ...
- 283
2
votes
1
answer
2k
views
Hash or encryption function for challenge-response protocol?
Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the ...
- 121
4
votes
3
answers
12k
views
How can I create a fixed length output in my hash function?
I've been recently looking into the creation (and theory) of hash functions, however I just can't figure out how to turn a message into something of a fixed length.
At the moment, my theory of a hash ...
user1143
8
votes
1
answer
4k
views
What is the proper way to use a client nonce?
I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure:
Client's Site (CS) requests nonce from My App (MA), posting their username
MA verifies the ...
- 283
24
votes
2
answers
5k
views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mathbin\| x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k \...
41
votes
3
answers
49k
views
What are preimage resistance and collision resistance, and how can the lack thereof be exploited?
What is "preimage resistance", and how can the lack thereof be exploited?
How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
- 1,505
27
votes
2
answers
6k
views
What is a hard-core predicate?
I read this article on Wikipedia: Hard-core predicate.
Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a ...
Kai
10
votes
2
answers
1k
views
Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?
I can't get an intuitive understanding of why it's $2^{(\frac{n}{2})}$ and not $2^n$, where $n$ is the number of bits of which the key consists.
- 201
60
votes
2
answers
19k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 703
15
votes
5
answers
5k
views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
- 283
12
votes
1
answer
3k
views
Why doesn't preimage resistance imply the second preimage resistance?
Let the preimage resistance be defined as »given a hash value $h$, it is hard to find any message $m$ such that $\operatorname{hash}(m)=h$«, and let the second preimage resistance be defined as »given ...
- 763
6
votes
5
answers
4k
views
Is there a hash function with 2048bit output?
Is there a publicly available cryptographic hashing algorithm with 2048 bit output?
The standard ones are "only" up to 512 bit (SHA-512, WHIRLPOOL).
(2048 bits are 256 bytes, so it would be useful ...
- 173
8
votes
2
answers
3k
views
Key Length & Hashing
I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit.
I am using the SRP protocol for authentication (a ...
- 81
17
votes
2
answers
10k
views
Strength of multiple hash iterations?
Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ...
- 663
40
votes
1
answer
33k
views
RIPEMD versus SHA-x, what are the main pros and cons?
RIPEMD is a family of cryptographic hash functions, meaning it competes for roughly the same uses as MD5, SHA-1 & SHA-256 do. The Wikipedia page for RIPEMD seems to have some nice things to say ...
user950
11
votes
3
answers
2k
views
How well does scrypt perform on different architectures / OSes?
The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
- 1,007
15
votes
3
answers
6k
views
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
- 293
20
votes
2
answers
17k
views
What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?
For the purposes of signing and verifying signatures, what is the value of the hash function?
Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
- 303
3
votes
1
answer
248
views
A set of key pairs and one hash to secure them
I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ...
- 1,669
5
votes
1
answer
280
views
Is the last step of an iterated cryptographic hash still as resistant to preimage attacks as the original hash?
Considering a cryptographic hash, such as MD5 or SHA2, denoted by the function $H(m)$ where $m$ is an arbitrary binary string, there is a lot of material available that deals with potential weakness ...
- 151
60
votes
3
answers
13k
views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared-...
- 701
49
votes
8
answers
31k
views
Is there a simple hash function that one can compute without a computer?
I am looking for a hash function that is computable by hand (in reasonable time). The function should be at least a little bit secure: There should be no trivial way to find a collision (by hand). For ...
- 593
7
votes
4
answers
2k
views
Webapp password storage: Salting a hash vs multiple hashes?
For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better.
But, if bad guys steal your ...
- 181
11
votes
3
answers
5k
views
Accelerating SHA-1
I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
- 4,128
54
votes
2
answers
39k
views
Why use an Initialization Vector (IV)?
Why use an Initialization Vector (IV)?
How are IV's used?
What are the advantages/disadvantages of using an IV?
Why use an IV instead of a longer key in which some section of the key is public?
What ...
- 2,266
4
votes
1
answer
443
views
How is the MJH double-block-length hash function constructed?
I'm looking for information on the MJH double-block-length hash function, but the best free source I could find is the diagram on page 18 of Efficient hashing using the AES Instruction Set (submitted ...
- 551
11
votes
5
answers
1k
views
How do I construct a 256-bit hash function from 128-bit AES?
I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher?
- 551
7
votes
4
answers
1k
views
Does MD5 generate 128 independent bits?
I heard that there are 128 stochastically independent bits in an MD5 output. Is that true?
If so, are there any citations or proofs for that?
- 173
2
votes
4
answers
452
views
Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
I have a scenario similar to the one described in Wikipedia: hash list, but with a twist. I'm looking for a cryptographically secure hash function that would create the same root hash for the same ...
- 145
16
votes
2
answers
2k
views
Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?
Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests?
Does the answer change if ...
- 263
34
votes
5
answers
6k
views
What security do Cryptographic Sponges offer against generic quantum attacks?
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:
Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second ...
- 1,430
12
votes
3
answers
3k
views
Is the number of creatable torrents limited?
Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
- 445
28
votes
7
answers
11k
views
Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size.
Normally, you sequentially hash the bytes of the files using a hash function (say, ...
8
votes
6
answers
1k
views
How can I improve a password generation scheme based on a shared secret and URL?
I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
...
- 183
1
vote
1
answer
2k
views
iSeries (AS/400) Database File: password encryption [closed]
I am helping with a project in which an old software system on an iSeries is having a brand new .NET UI applied to it. It's going well... except...
In order to allow users to login and maintain ...
- 111
32
votes
3
answers
5k
views
Are common cryptographic hashes bijective when hashing a single block of the same size as the output?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3?
For example, would SHA-512 be ...
- 1,867
20
votes
3
answers
11k
views
Cryptanalysis to reverse engineer a hash?
I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question.
I have inputs and outputs from an in-...
- 211
9
votes
4
answers
6k
views
What alphanumeric string length can be used to guarantee no hash collisions from CRC-64? [closed]
If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
- 193
14
votes
4
answers
2k
views
Properties of PRNG / Hashes?
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.
So, I was wondering how ...
- 283
89
votes
8
answers
13k
views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
- 22.6k
11
votes
1
answer
4k
views
Change in probability of collision when removing digits from MD5 hexadecimal hash values
I am aware that MD5 has a known collision vulnerability and should not be relied upon when uniqueness is required, but in the environment I am working on I only have access to MD5 hash function. ...
- 1,387
33
votes
1
answer
8k
views
Should I use the first or last bits from a SHA-256 hash?
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash.
Should I take the first bits or the last bits? Which of them ...
- 433
12
votes
1
answer
714
views
Can one efficiently iterate valid bcrypt hash output values?
bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password.
An efficient attack on this would ...
- 22.6k
21
votes
6
answers
2k
views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively:
$U_1 = PRF(password, salt)$
$U_2 = PRF(password, U_1)$
…
$U_n = PRF(...
- 313
23
votes
3
answers
3k
views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
- 22.6k
24
votes
4
answers
6k
views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
- 1,505
24
votes
4
answers
1k
views
Necessity of Randomness of Salts?
Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user?
If your system already has some other unique user ...
- 659