Questions tagged [preimage-resistance]

Difficulty of finding an input string that hashes to a given value

Filter by
Sorted by
Tagged with
4 votes
2 answers
88 views

Does having multiple salted hashes lower pre-image resistance?

A common method to mitigate the effect of rainbow tables is to add a string to the end of the user password before hashing, a process known as salting. However, let’s say for example that someone uses ...
0 votes
0 answers
26 views

Properties of specific hash function [closed]

Let p be a prime number of length k bits. Let H(x) = x2 (mod p) be a hash function which maps any message to a k-bit hash value. (a) Is this function pre-image resistant? Why? (b) Is this function ...
2 votes
1 answer
47 views

How do the c-bits (capacity bits) make the sponge construction better?

I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
0 votes
0 answers
36 views

Best progress on pre-image attacks?

What is the best progress (i.e. most bits) in crafting messages with a chosen hash image for modern hash functions? Blockchain networks with proof of work are basically brute force machines for pre-...
4 votes
1 answer
1k views

How secure is SHA-1 against preimage attacks currently?

We know that SHA-1 is susceptible to collision attacks, but what about pre-image attacks such as poisoning torrents?
  • 699
5 votes
1 answer
517 views

How can a preimage attack on SHA-256 always succeed within 2^256 evaluations when done though brute force?

I was reading the Wikipedia page for SHA-256 (SHA-2) and came across the following statement: For a hash function for which $L$ is the number of bits in the message digest, finding a message that ...
4 votes
2 answers
365 views

Password hashing and salting with SHA-256 on $2^{64}$ password space

If a password is randomly chosen from a space of $2^{64}$ passwords and is stored as an SHA-256-bit hash and a 128-bit salt, how many hashes does an attacker need to perform to recover the password in ...
2 votes
1 answer
156 views

How do Pre-image, Second pre-image and collision resistance actually work? How does this affect data integrity?

I'm working on this past exam paper and found this question about pre-image resistance and its relation to data integrity: Displaying the hash of a file on a website in order to provide data integrity ...
  • 183
1 vote
1 answer
207 views

Which hash functions provide 128 bit resistance?

I was wondering out of the functions (MD5, SHA-1, SHA-256, and SHA-512), do all provide 128-bit pre-image resistance and 128-bit second-image resistance? Also, out of these hash functions, do only SHA-...
1 vote
1 answer
95 views

Probabilistic SHA-256 hash tending all values to 0.5

I wrote SHA-256 with arrays of integers representing the bits (e.g. [1,0,...,1]), and then I altered it to accept partial values (e.g. [0.5, 0.79, 0.0, 1]), as in each value has an x chance of being '...
0 votes
0 answers
93 views

Determine if a Hash function is pre-image resistant and collision free

I'm so confused by this kind of exercise. We have that $n = p * q$, where $p$ and $q$ are prime numbers. Let's examine this hash function: $h(x) = x^2 \mod n$. Determine if the hash function is pre-...
0 votes
0 answers
23 views

Why we need DSPR or Eq. 14 for the proof of SPHNICS+?

The paper says that We show that preimage resistance (PRE) follows tightly from the conjunction of second-preimage resistance (SPR) and decisional second-preimage resistance (DSPR). As I understand ...
  • 73
1 vote
1 answer
113 views

Approximate size of image of SHA512

Let $s: \{0,1\}^* \to \{0,1\}^{512}$ be the SHA512 hash (where $\{0,1\}^*$ is the countable set of all finite $\{0,1\}$ strings. Is it known whether $|\text{im}(s)|/2^{512} \geq 0.5$? If yes, what is ...
0 votes
0 answers
38 views

Collision and pre-image resistances of a hash function based on SPRP

Assume we have a secure block cipher $E$ (strong pseudorandom permutation) and a fixed key $k$ which are publicly known. We construct our hash function $H(m)$ as $$ H(m) = E_k(m_1) \oplus \dots \oplus ...
0 votes
0 answers
77 views

1st Preimage, 2nd Preimage, Collision resistance of powers of 2 mod n

Let $n$ be a product of two odd, distinct large primes $p$ and $q$. Define the hash function as $$ H_{F}(x)=2^{x} \bmod n $$ Is this hash function resistant to 1st/2nd preimage and collision attacks? ...
0 votes
0 answers
15 views

How to assign md5 of another file to one wav file? [duplicate]

Good afternoon . Please tell me how to change the md5 hash of one wav file to the md5 hash of another wav file. I want to bypass the anti-cheat check on md5. Maybe there are online paid services? I ...
  • 1
1 vote
1 answer
207 views

Are such verification wormholes known, or even possible?

1. Scenario Suppose that we have a source that is generating one random value per, say, minute. So we have random value $x_1$ in $1$st minute, $x_2$ in $2$nd minute, $\ldots$, $x_n$ in the $n$th ...
  • 541
12 votes
5 answers
3k views

Hash paradox in an image file that contain hash text?

Is it possible to include a hash digest visibly in an image, such that the hash of the image itself is that same digest? When we draw the text of the hash in the image, we will of course change the ...
1 vote
0 answers
637 views

How to find the 6 main properties of cryptographic hash functions when implementing a hash function?

According to this there are at least 6 "properties" all cryptographically secure hash functions strive to attain: Deterministic: the same message always results in the same hash; Quick: it ...
  • 171
2 votes
0 answers
119 views

Why this function isn't second preimage resistant?

Why is $h(k,m)$ not second-preimage resistant? Let $E_k$ be a block cipher where the message space is the same as the key space. $$h(k,m)=E_k(m\oplus k)\oplus k$$ I've been reading about second ...
  • 21
2 votes
0 answers
38 views

composing password hash functions

Firstly I know that what I'm asking about is not practical, so let's keep it theoretical. Let $B[H](x)$ be balloon hashing with $H$ as it's underlying hash. What happens if I do $B[H1](B[H2](x))$, ...
0 votes
1 answer
115 views

Why is this image not pre-image resistant?

The answers to my HW say that a preimage of a single block is easily found. I do not understand how it is easily found. Please help.
2 votes
1 answer
212 views

Pre-image attack on non-cryptographic hash functions

I am not good at cryptography so please :) After reading this discussion it is now clear to me that xxHash is not resistant to collision attacks and is not secure for MAC usage. But after reading it, ...
-1 votes
1 answer
51 views

Is it possible to have collision resistance but not pre-image and 2nd pre-image resistance?

I have studied cryptographic hash functions quite a lot, but have not completely understood whether it is possible to have collision resistance but not pre-image and 2nd pre-image resistance at the ...
1 vote
1 answer
80 views

Preimage attack on sum of two Hash functions modulo 2

If a hash function $H$ is defined as $H(x_1,x_2) = H_1(x_1) \oplus H_2(x_2)$ for two n bit good hash functions $H_1$ and $H_2$ then how can we construct a preimage attack on $H$ that is of $O(2^\frac{...
1 vote
1 answer
107 views

Is it possible to exploit MD5 weaknesses to create an artificial collision for a password?

If it is possible, could an attacker create a collision for an MD5 password in a database? Could they look at an MD5 hash output and figure out data that creates the same MD5 hash?
2 votes
2 answers
1k views

How to unhash sha256? Alternatives to brute force?

I know it's almost impossible to do, SHA256 is a one-way function that can't be easily reversed, just like there are operations that have no reverse, take: $f(x) = x+5$ , it's easy to see that if you ...
user avatar
1 vote
1 answer
107 views

Complexity of Hash mining/signing

While reading about mining in crypto currency, I found that it requires some leading bits of a hash function output to be 0. This boils down to preimage resistance of the hash function, hence done ...
  • 593
1 vote
1 answer
119 views

if a hash function has no known preimage attacks, does that mean there are no known attacks against using it in signatures?

Suppose a hash function like SHA-1 has known collision attacks (including chosen-prefix collision attacks) but no known preimage attacks. Does that mean there are no known attacks against using it in ...
  • 145
1 vote
1 answer
230 views

Attack MD5 with limited input and partial information

If I know that MD5 input is limited to a character set. can I find any information on the input based on the output? example: input consists of 16 character from list of [1,2,3,4,5]. question: based ...
  • 113
1 vote
0 answers
84 views

Does this break the pre-image resistance of the hash function?

Supposing a secure hash function $f(\cdot): \{0,1\}^* \rightarrow \{0,1\}^n$ satisfies pre-image resistance. That is, given a hash value $y$ it should be difficult to find any message $x$ such that $y ...
3 votes
2 answers
249 views

Application of cryptographic hash functions which do not require collision resistance property

I can not understand why collision resistance of a cryptographic hash function is not required for some applications. for example, if we store the trusted hash of a file or program, and later when we ...
  • 43
2 votes
1 answer
265 views

What are the “costs” to find a pre-image, weak collision, or strong collision?

For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
  • 23
0 votes
0 answers
150 views

Does this qualify as a one-way function?

First, we observe that the expression X*Y mod P (where X and Y are secret and P is a large public prime) reveals no useful information. Next we define an extending function E(U, M) which "somehow&...
2 votes
1 answer
294 views

Practicality of a certain hash function

Consider the following hash function: $$(V\cdot A + V\cdot B)^2 \bmod C$$ $A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
1 vote
0 answers
145 views

Preimage security of combined hash functions

I am struggling with a property of combined hash function and more precisely concatenation. I have seen that concatenating two collision resistant hash functions preserves this property (same for 2nd ...
  • 11
1 vote
0 answers
83 views

Changing a bit in IV of MD5

It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
  • 165
1 vote
1 answer
158 views

finding second pseudo preimage faster than brute force

As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
  • 165
0 votes
2 answers
333 views

Showing a CBC-MAC is not preimage resistant with a proof

So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$. I want to be able to that this won't be preimage ...
1 vote
1 answer
53 views

Breaking keyed hash function with half-randomized input

Let's say we have keyed hash function which transforms $256$-bit input into $256$-bit output and the attacker knows the key (let's say the key is $256$-bit long). Now let's consider we will construct ...
  • 1,129
3 votes
1 answer
380 views

Do hash functions for digital signatures need to be preimage resistant?

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
  • 159
1 vote
0 answers
106 views

Where do hash functions get their preimage resistance?

I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process. Here is the much simpler hash function I ...
5 votes
1 answer
863 views

How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
  • 247
4 votes
2 answers
1k views

Are My Answers to This Hash Question Correct?

Question When determining the security of a hash system, the cryptanalyst tries the following attacks. (a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
  • 43
6 votes
3 answers
2k views

Minimum input size of a hash function

This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $...
0 votes
1 answer
542 views

How to determine if a hash is pre image resistant or collision free

Let $H : \{0,1\}^*\to \{1,\dots, 2^{256}\}$ be a hash function. Let $p > 2^{256}$ be a safe prime, and $\alpha$ a primitive root for $p$. Define: $$H'(m) = H(m || m),\quad H''(m) = \alpha^{H(m)}\...
1 vote
1 answer
215 views

Potential weaknesses when combining hash functions?

For consistency's sake, M is the message, H1 and H2 are separate hash functions. I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and ...
1 vote
1 answer
114 views

Could multicollisions be used to mine large amounts of cryptocurrency?

I'm reading about hash functions at the moment, and in the book I'm reading there's a section on multicollisions. Specifically, using a 2-collision to find $2^N$ collisions in $N2^N$ time. If, ...
1 vote
0 answers
176 views

"Reversing" SHA256 [duplicate]

Let's say I give you the sha256 hash of my password, which I'll call X. Now, the sha256 algorithm is a one-way function, meaning you can give it some input and get an output, but you can't get the ...
0 votes
0 answers
379 views

Is it possible to reverse the final rounds of SHA-256

I've seen a lot of preimage and collision attacks on SHA-256 that target the first few rounds. So far, the best attacks break preimage resistance for the first 52 rounds out of 64 rounds. However, I'...
  • 133