Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [preimage-resistance]

Difficulty of finding an input string that hashes to a given value

Filter by
Sorted by
Tagged with
1 vote
1 answer
82 views

How to use smt solvers in order to restrict the possible key search where a portion of the private key and a portion of the public key hash is known?

I’m in the following situation : I’ve a portion/first bytes of a private secp256k1 security key such as it would take minutes to fully recover it through Pollard’s Kangaroo if I had the public key. ...
user2284570's user avatar
3 votes
1 answer
432 views

SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS

By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256 i.e. SHAKE256_256(M) = SHAKE256(M,256) What is the motivation of choosing SHAKE256_256 ...
user's user avatar
  • 173
0 votes
0 answers
69 views

Is a reduced character space pre-image attack possible for SHA-1?

Given a hash cipher f(sha1($pepper . $plaintext)) where f is some transformation to an 11-byte string pepper is 24 bytes long with a character space of 62 (and is ...
Carmina Martin's user avatar
3 votes
0 answers
115 views

Sponge capacity feed-forward

Consider Sponge construction where capacity part of state is feed-forward and xor-ed into next state. ${state}_{i+1} = F({{state}_i}^{rate} || {{state}_i}^{capacity}) \oplus (0^{rate} || {{state}_i}^{...
LightBit's user avatar
  • 1,649
2 votes
0 answers
105 views

Security of Even-Mansour based Merkle-Damgård

Assuming I have single-key Even-Mansour with single $2n$-bit permutation in wide-pipe Merkle-Damgård specifically with Matyas-Meyer-Oseas mode outputting $n$-bit hash. What security can I expect ...
LightBit's user avatar
  • 1,649
5 votes
2 answers
152 views

Does having multiple salted hashes lower pre-image resistance?

A common method to mitigate the effect of rainbow tables is to add a string to the end of the user password before hashing, a process known as salting. However, let’s say for example that someone uses ...
Joshiepillow's user avatar
2 votes
1 answer
125 views

How do the c-bits (capacity bits) make the sponge construction better?

I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
questions change the world's user avatar
0 votes
0 answers
60 views

Best progress on pre-image attacks?

What is the best progress (i.e. most bits) in crafting messages with a chosen hash image for modern hash functions? Blockchain networks with proof of work are basically brute force machines for pre-...
William Entriken's user avatar
6 votes
1 answer
2k views

How secure is SHA-1 against preimage attacks currently?

We know that SHA-1 is susceptible to collision attacks, but what about pre-image attacks such as poisoning torrents?
Hormoz's user avatar
  • 799
5 votes
1 answer
701 views

How can a preimage attack on SHA-256 always succeed within 2^256 evaluations when done though brute force?

I was reading the Wikipedia page for SHA-256 (SHA-2) and came across the following statement: For a hash function for which $L$ is the number of bits in the message digest, finding a message that ...
Darcy Sutton's user avatar
4 votes
2 answers
2k views

Password hashing and salting with SHA-256 on $2^{64}$ password space

If a password is randomly chosen from a space of $2^{64}$ passwords and is stored as an SHA-256-bit hash and a 128-bit salt, how many hashes does an attacker need to perform to recover the password in ...
CryptoGuru's user avatar
3 votes
1 answer
347 views

How do Pre-image, Second pre-image and collision resistance actually work? How does this affect data integrity?

I'm working on this past exam paper and found this question about pre-image resistance and its relation to data integrity: Displaying the hash of a file on a website in order to provide data integrity ...
Thanos's user avatar
  • 193
1 vote
1 answer
561 views

Which hash functions provide 128 bit resistance?

I was wondering out of the functions (MD5, SHA-1, SHA-256, and SHA-512), do all provide 128-bit pre-image resistance and 128-bit second-image resistance? Also, out of these hash functions, do only SHA-...
CryptoGuru's user avatar
1 vote
1 answer
107 views

Probabilistic SHA-256 hash tending all values to 0.5

I wrote SHA-256 with arrays of integers representing the bits (e.g. [1,0,...,1]), and then I altered it to accept partial values (e.g. [0.5, 0.79, 0.0, 1]), as in each value has an x chance of being '...
Alex Breeze's user avatar
0 votes
0 answers
162 views

Determine if a Hash function is pre-image resistant and collision free

I'm so confused by this kind of exercise. We have that $n = p * q$, where $p$ and $q$ are prime numbers. Let's examine this hash function: $h(x) = x^2 \mod n$. Determine if the hash function is pre-...
Giorgio Doneddu's user avatar
1 vote
1 answer
155 views

Approximate size of image of SHA512

Let $s: \{0,1\}^* \to \{0,1\}^{512}$ be the SHA512 hash (where $\{0,1\}^*$ is the countable set of all finite $\{0,1\}$ strings. Is it known whether $|\text{im}(s)|/2^{512} \geq 0.5$? If yes, what is ...
Dominic van der Zypen's user avatar
0 votes
0 answers
16 views

How to assign md5 of another file to one wav file? [duplicate]

Good afternoon . Please tell me how to change the md5 hash of one wav file to the md5 hash of another wav file. I want to bypass the anti-cheat check on md5. Maybe there are online paid services? I ...
DEFJAM's user avatar
  • 1
2 votes
1 answer
288 views

Are such verification wormholes known, or even possible?

1. Scenario Suppose that we have a source that is generating one random value per, say, minute. So we have random value $x_1$ in $1$st minute, $x_2$ in $2$nd minute, $\ldots$, $x_n$ in the $n$th ...
caveman's user avatar
  • 573
12 votes
5 answers
3k views

Hash paradox in an image file that contain hash text?

Is it possible to include a hash digest visibly in an image, such that the hash of the image itself is that same digest? When we draw the text of the hash in the image, we will of course change the ...
Muhammad Ikhwan Perwira's user avatar
1 vote
0 answers
1k views

How to find the 6 main properties of cryptographic hash functions when implementing a hash function?

According to this there are at least 6 "properties" all cryptographically secure hash functions strive to attain: Deterministic: the same message always results in the same hash; Quick: it ...
Lance's user avatar
  • 171
2 votes
0 answers
130 views

Why this function isn't second preimage resistant?

Why is $h(k,m)$ not second-preimage resistant? Let $E_k$ be a block cipher where the message space is the same as the key space. $$h(k,m)=E_k(m\oplus k)\oplus k$$ I've been reading about second ...
Emma's user avatar
  • 21
2 votes
0 answers
42 views

composing password hash functions

Firstly I know that what I'm asking about is not practical, so let's keep it theoretical. Let $B[H](x)$ be balloon hashing with $H$ as it's underlying hash. What happens if I do $B[H1](B[H2](x))$, ...
kebabdubai's user avatar
0 votes
1 answer
218 views

Why is this image not pre-image resistant?

The answers to my HW say that a preimage of a single block is easily found. I do not understand how it is easily found. Please help.
Dominic Teplicky's user avatar
3 votes
1 answer
402 views

Pre-image attack on non-cryptographic hash functions

I am not good at cryptography so please :) After reading this discussion it is now clear to me that xxHash is not resistant to collision attacks and is not secure for MAC usage. But after reading it, ...
Eugene Sirkiza's user avatar
-1 votes
1 answer
61 views

Is it possible to have collision resistance but not pre-image and 2nd pre-image resistance?

I have studied cryptographic hash functions quite a lot, but have not completely understood whether it is possible to have collision resistance but not pre-image and 2nd pre-image resistance at the ...
Nimrita sain's user avatar
1 vote
1 answer
97 views

Preimage attack on sum of two Hash functions modulo 2

If a hash function $H$ is defined as $H(x_1,x_2) = H_1(x_1) \oplus H_2(x_2)$ for two n bit good hash functions $H_1$ and $H_2$ then how can we construct a preimage attack on $H$ that is of $O(2^\frac{...
user766787's user avatar
1 vote
1 answer
141 views

Is it possible to exploit MD5 weaknesses to create an artificial collision for a password?

If it is possible, could an attacker create a collision for an MD5 password in a database? Could they look at an MD5 hash output and figure out data that creates the same MD5 hash?
Practixal's user avatar
2 votes
2 answers
2k views

How to unhash sha256? Alternatives to brute force?

I know it's almost impossible to do, SHA256 is a one-way function that can't be easily reversed, just like there are operations that have no reverse, take: $f(x) = x+5$ , it's easy to see that if you ...
user avatar
1 vote
1 answer
122 views

Complexity of Hash mining/signing

While reading about mining in crypto currency, I found that it requires some leading bits of a hash function output to be 0. This boils down to preimage resistance of the hash function, hence done ...
hola's user avatar
  • 603
1 vote
1 answer
200 views

if a hash function has no known preimage attacks, does that mean there are no known attacks against using it in signatures?

Suppose a hash function like SHA-1 has known collision attacks (including chosen-prefix collision attacks) but no known preimage attacks. Does that mean there are no known attacks against using it in ...
Bennett's user avatar
  • 165
1 vote
1 answer
385 views

Attack MD5 with limited input and partial information

If I know that MD5 input is limited to a character set. can I find any information on the input based on the output? example: input consists of 16 character from list of [1,2,3,4,5]. question: based ...
Mojtaba's user avatar
  • 113
1 vote
0 answers
85 views

Does this break the pre-image resistance of the hash function?

Supposing a secure hash function $f(\cdot): \{0,1\}^* \rightarrow \{0,1\}^n$ satisfies pre-image resistance. That is, given a hash value $y$ it should be difficult to find any message $x$ such that $y ...
Zi-Yuan Liu's user avatar
3 votes
2 answers
307 views

Application of cryptographic hash functions which do not require collision resistance property

I can not understand why collision resistance of a cryptographic hash function is not required for some applications. for example, if we store the trusted hash of a file or program, and later when we ...
John's user avatar
  • 43
4 votes
1 answer
580 views

What are the “costs” to find a pre-image, weak collision, or strong collision?

For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
Renato's user avatar
  • 43
0 votes
0 answers
161 views

Does this qualify as a one-way function?

First, we observe that the expression X*Y mod P (where X and Y are secret and P is a large public prime) reveals no useful information. Next we define an extending function E(U, M) which "somehow&...
Sir Galahad's user avatar
2 votes
1 answer
301 views

Practicality of a certain hash function

Consider the following hash function: $$(V\cdot A + V\cdot B)^2 \bmod C$$ $A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
Sir Galahad's user avatar
1 vote
0 answers
197 views

Preimage security of combined hash functions

I am struggling with a property of combined hash function and more precisely concatenation. I have seen that concatenating two collision resistant hash functions preserves this property (same for 2nd ...
BMalone's user avatar
  • 11
1 vote
0 answers
116 views

Changing a bit in IV of MD5

It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
abbas's user avatar
  • 165
1 vote
1 answer
285 views

finding second pseudo preimage faster than brute force

As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
abbas's user avatar
  • 165
0 votes
2 answers
423 views

Showing a CBC-MAC is not preimage resistant with a proof

So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$. I want to be able to that this won't be preimage ...
gigaman76543's user avatar
1 vote
1 answer
71 views

Breaking keyed hash function with half-randomized input

Let's say we have keyed hash function which transforms $256$-bit input into $256$-bit output and the attacker knows the key (let's say the key is $256$-bit long). Now let's consider we will construct ...
Tom's user avatar
  • 1,221
3 votes
1 answer
603 views

Do hash functions for digital signatures need to be preimage resistant?

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
XDAF's user avatar
  • 159
1 vote
0 answers
111 views

Where do hash functions get their preimage resistance?

I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process. Here is the much simpler hash function I ...
user6629259's user avatar
5 votes
1 answer
1k views

How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
evernal's user avatar
  • 237
4 votes
2 answers
2k views

Are My Answers to This Hash Question Correct?

Question When determining the security of a hash system, the cryptanalyst tries the following attacks. (a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
John's user avatar
  • 43
6 votes
3 answers
2k views

Minimum input size of a hash function

This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $...
Cryptography Learner's user avatar
0 votes
1 answer
847 views

How to determine if a hash is pre image resistant or collision free

Let $H : \{0,1\}^*\to \{1,\dots, 2^{256}\}$ be a hash function. Let $p > 2^{256}$ be a safe prime, and $\alpha$ a primitive root for $p$. Define: $$H'(m) = H(m || m),\quad H''(m) = \alpha^{H(m)}\...
Anonymous's user avatar
1 vote
1 answer
259 views

Potential weaknesses when combining hash functions?

For consistency's sake, M is the message, H1 and H2 are separate hash functions. I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and ...
Anonymous's user avatar
1 vote
1 answer
153 views

Could multicollisions be used to mine large amounts of cryptocurrency?

I'm reading about hash functions at the moment, and in the book I'm reading there's a section on multicollisions. Specifically, using a 2-collision to find $2^N$ collisions in $N2^N$ time. If, ...
Radvylf Programs's user avatar
1 vote
0 answers
180 views

"Reversing" SHA256 [duplicate]

Let's say I give you the sha256 hash of my password, which I'll call X. Now, the sha256 algorithm is a one-way function, meaning you can give it some input and get an output, but you can't get the ...
Ömer Enes Özmen's user avatar