Questions tagged [preimage-resistance]
Difficulty of finding an input string that hashes to a given value
172
questions
1
vote
2
answers
137
views
Looking for a lightweight hashing algorithm
I'm looking for a hashing algorithm with some unique properties:
Most important: It has to be small. Ideally ~400 bytes of x86 assembly
Resistant to preimage & collision attacks with no known ...
- 11
1
vote
1
answer
142
views
How to use smt solvers in order to restrict the possible key search where a portion of the private key and a portion of the public key hash is known?
I’m in the following situation :
I’ve a portion/first bytes of a private secp256k1 security key such as it would take minutes to fully recover it through Pollard’s Kangaroo if I had the public key.
...
- 240
3
votes
1
answer
471
views
SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS
By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256
i.e. SHAKE256_256(M) = SHAKE256(M,256)
What is the motivation of choosing SHAKE256_256 ...
- 193
0
votes
0
answers
71
views
Is a reduced character space pre-image attack possible for SHA-1?
Given a hash cipher f(sha1($pepper . $plaintext)) where
f is some transformation to an 11-byte string
pepper is 24 bytes long with a character space of 62 (and is ...
3
votes
0
answers
117
views
Sponge capacity feed-forward
Consider Sponge construction where capacity part of state is feed-forward and xor-ed into next state.
${state}_{i+1} = F({{state}_i}^{rate} || {{state}_i}^{capacity}) \oplus (0^{rate} || {{state}_i}^{...
- 1,682
2
votes
0
answers
105
views
Security of Even-Mansour based Merkle-Damgård
Assuming I have single-key Even-Mansour with single $2n$-bit permutation in wide-pipe Merkle-Damgård specifically with Matyas-Meyer-Oseas mode outputting $n$-bit hash.
What security can I expect ...
- 1,682
5
votes
2
answers
159
views
Does having multiple salted hashes lower pre-image resistance?
A common method to mitigate the effect of rainbow tables is to add a string to the end of the user password before hashing, a process known as salting.
However, let’s say for example that someone uses ...
- 153
3
votes
1
answer
140
views
How do the c-bits (capacity bits) make the sponge construction better?
I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
0
votes
0
answers
74
views
Best progress on pre-image attacks?
What is the best progress (i.e. most bits) in crafting messages with a chosen hash image for modern hash functions?
Blockchain networks with proof of work are basically brute force machines for pre-...
- 171
6
votes
1
answer
2k
views
How secure is SHA-1 against preimage attacks currently?
We know that SHA-1 is susceptible to collision attacks, but what about pre-image attacks such as poisoning torrents?
- 799
5
votes
1
answer
730
views
How can a preimage attack on SHA-256 always succeed within 2^256 evaluations when done though brute force?
I was reading the Wikipedia page for SHA-256 (SHA-2) and came across the following statement:
For a hash function for which $L$ is the number of bits in the message digest, finding a message that ...
- 300
4
votes
2
answers
2k
views
Password hashing and salting with SHA-256 on $2^{64}$ password space
If a password is randomly chosen from a space of $2^{64}$ passwords and is stored as an SHA-256-bit hash and a 128-bit salt, how many hashes does an attacker need to perform to recover the password in ...
- 161
3
votes
1
answer
371
views
How do Pre-image, Second pre-image and collision resistance actually work? How does this affect data integrity?
I'm working on this past exam paper and found this question about pre-image resistance and its relation to data integrity:
Displaying the hash of a file on a website in order to provide data integrity ...
- 193
1
vote
1
answer
661
views
Which hash functions provide 128 bit resistance?
I was wondering out of the functions (MD5, SHA-1, SHA-256, and SHA-512), do all provide 128-bit pre-image resistance and 128-bit second-image resistance?
Also, out of these hash functions, do only SHA-...
- 161
1
vote
1
answer
107
views
Probabilistic SHA-256 hash tending all values to 0.5
I wrote SHA-256 with arrays of integers representing the bits (e.g. [1,0,...,1]), and then I altered it to accept partial values (e.g. [0.5, 0.79, 0.0, 1]), as in each value has an x chance of being '...
- 41
0
votes
0
answers
162
views
Determine if a Hash function is pre-image resistant and collision free
I'm so confused by this kind of exercise.
We have that $n = p * q$, where $p$ and $q$ are prime numbers. Let's examine this hash function:
$h(x) = x^2 \mod n$.
Determine if the hash function is pre-...
1
vote
1
answer
156
views
Approximate size of image of SHA512
Let $s: \{0,1\}^* \to \{0,1\}^{512}$ be the SHA512 hash (where $\{0,1\}^*$ is the countable set of all finite $\{0,1\}$ strings.
Is it known whether $|\text{im}(s)|/2^{512} \geq 0.5$?
If yes, what is ...
0
votes
0
answers
16
views
How to assign md5 of another file to one wav file? [duplicate]
Good afternoon . Please tell me how to change the md5 hash of one wav file to the md5 hash of another wav file. I want to bypass the anti-cheat check on md5. Maybe there are online paid services? I ...
- 1
2
votes
1
answer
306
views
Are such verification wormholes known, or even possible?
1. Scenario
Suppose that we have a source that is generating one random value per, say, minute. So we have random value $x_1$ in $1$st minute, $x_2$ in $2$nd minute, $\ldots$, $x_n$ in the $n$th ...
- 573
12
votes
5
answers
3k
views
Hash paradox in an image file that contain hash text?
Is it possible to include a hash digest visibly in an image, such that the hash of the image itself is that same digest?
When we draw the text of the hash in the image, we will of course change the ...
1
vote
0
answers
1k
views
How to find the 6 main properties of cryptographic hash functions when implementing a hash function?
According to this there are at least 6 "properties" all cryptographically secure hash functions strive to attain:
Deterministic: the same message always results in the same hash;
Quick: it ...
- 171
2
votes
0
answers
130
views
Why this function isn't second preimage resistant?
Why is $h(k,m)$ not second-preimage resistant? Let $E_k$ be a block cipher where the message space is the same as the key space.
$$h(k,m)=E_k(m\oplus k)\oplus k$$
I've been reading about second ...
- 21
2
votes
0
answers
42
views
composing password hash functions
Firstly I know that what I'm asking about is not practical, so let's keep it theoretical.
Let $B[H](x)$ be balloon hashing with $H$ as it's underlying hash.
What happens if I do $B[H1](B[H2](x))$, ...
- 21
0
votes
1
answer
220
views
Why is this image not pre-image resistant?
The answers to my HW say that a preimage of a single block is easily found. I do not understand how it is easily found. Please help.
4
votes
1
answer
523
views
Pre-image attack on non-cryptographic hash functions
I am not good at cryptography so please :)
After reading this discussion it is now clear to me that xxHash is not resistant to collision attacks and is not secure for MAC usage. But after reading it, ...
- 143
-1
votes
1
answer
65
views
Is it possible to have collision resistance but not pre-image and 2nd pre-image resistance?
I have studied cryptographic hash functions quite a lot, but have not completely understood whether it is possible to have collision resistance but not pre-image and 2nd pre-image resistance at the ...
1
vote
1
answer
101
views
Preimage attack on sum of two Hash functions modulo 2
If a hash function $H$ is defined as $H(x_1,x_2) = H_1(x_1) \oplus H_2(x_2)$
for two n bit good hash functions $H_1$ and $H_2$
then how can we construct a preimage attack on $H$ that is of $O(2^\frac{...
- 35
1
vote
1
answer
156
views
Is it possible to exploit MD5 weaknesses to create an artificial collision for a password?
If it is possible, could an attacker create a collision for an MD5 password in a database? Could they look at an MD5 hash output and figure out data that creates the same MD5 hash?
- 11
2
votes
2
answers
3k
views
How to unhash sha256? Alternatives to brute force?
I know it's almost impossible to do, SHA256 is a one-way function that can't be easily reversed, just like there are operations that have no reverse, take:
$f(x) = x+5$ , it's easy to see that if you ...
Simon
1
vote
1
answer
128
views
Complexity of Hash mining/signing
While reading about mining in crypto currency, I found that it requires some leading bits of a hash function output to be 0. This boils down to preimage resistance of the hash function, hence done ...
- 603
1
vote
1
answer
205
views
if a hash function has no known preimage attacks, does that mean there are no known attacks against using it in signatures?
Suppose a hash function like SHA-1 has known collision attacks (including chosen-prefix collision attacks) but no known preimage attacks.
Does that mean there are no known attacks against using it in ...
- 165
1
vote
1
answer
402
views
Attack MD5 with limited input and partial information
If I know that MD5 input is limited to a character set. can I find any information on the input based on the output?
example:
input consists of 16 character from list of [1,2,3,4,5].
question:
based ...
- 113
1
vote
0
answers
85
views
Does this break the pre-image resistance of the hash function?
Supposing a secure hash function $f(\cdot): \{0,1\}^* \rightarrow \{0,1\}^n$ satisfies pre-image resistance.
That is, given a hash value $y$ it should be difficult to find any message $x$ such that $y ...
- 113
3
votes
2
answers
313
views
Application of cryptographic hash functions which do not require collision resistance property
I can not understand why collision resistance of a cryptographic hash function is not required for some applications. for example, if we store the trusted hash of a file or program, and later when we ...
- 43
4
votes
1
answer
601
views
What are the “costs” to find a pre-image, weak collision, or strong collision?
For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
- 43
0
votes
0
answers
161
views
Does this qualify as a one-way function?
First, we observe that the expression X*Y mod P (where X and Y are secret and P is a large public prime) reveals no useful information.
Next we define an extending function E(U, M) which "somehow&...
- 55
2
votes
1
answer
304
views
Practicality of a certain hash function
Consider the following hash function:
$$(V\cdot A + V\cdot B)^2 \bmod C$$
$A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
- 55
1
vote
0
answers
200
views
Preimage security of combined hash functions
I am struggling with a property of combined hash function and more precisely concatenation.
I have seen that concatenating two collision resistant hash functions preserves this property (same for 2nd ...
- 11
1
vote
0
answers
133
views
Changing a bit in IV of MD5
It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
- 175
1
vote
1
answer
302
views
finding second pseudo preimage faster than brute force
As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
- 175
0
votes
2
answers
426
views
Showing a CBC-MAC is not preimage resistant with a proof
So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$.
I want to be able to that this won't be preimage ...
1
vote
1
answer
72
views
Breaking keyed hash function with half-randomized input
Let's say we have keyed hash function which transforms $256$-bit input into $256$-bit output and the attacker knows the key (let's say the key is $256$-bit long). Now let's consider we will construct ...
- 1,241
3
votes
1
answer
636
views
Do hash functions for digital signatures need to be preimage resistant?
I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
- 159
1
vote
0
answers
111
views
Where do hash functions get their preimage resistance?
I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process.
Here is the much simpler hash function I ...
- 11
5
votes
1
answer
2k
views
How does second pre-image attack on Merkle Signature Scheme work?
I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
- 237
4
votes
2
answers
2k
views
Are My Answers to This Hash Question Correct?
Question
When determining the security of a hash system, the cryptanalyst tries the following attacks.
(a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
- 43
6
votes
3
answers
2k
views
Minimum input size of a hash function
This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $...
0
votes
1
answer
856
views
How to determine if a hash is pre image resistant or collision free
Let $H : \{0,1\}^*\to \{1,\dots, 2^{256}\}$ be a hash function.
Let $p > 2^{256}$ be a safe prime, and $\alpha$ a primitive root for $p$.
Define:
$$H'(m) = H(m || m),\quad H''(m) = \alpha^{H(m)}\...
1
vote
1
answer
266
views
Potential weaknesses when combining hash functions?
For consistency's sake, M is the message, H1 and H2 are separate hash functions.
I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and ...
- 11
1
vote
1
answer
161
views
Could multicollisions be used to mine large amounts of cryptocurrency?
I'm reading about hash functions at the moment, and in the book I'm reading there's a section on multicollisions. Specifically, using a 2-collision to find $2^N$ collisions in $N2^N$ time.
If, ...
- 117