Questions tagged [preimage-resistance]

Difficulty of finding an input string that hashes to a given value

Filter by
Sorted by
Tagged with
0
votes
0answers
43 views

How to find the right data for generate a partial SHA-256

I have 12 bytes (5 fixed and 8 variable) of data that will be passed to SHA-256, at the end only the last 5 (most significant) bytes of the 20 generated are checked, is there a way to generate the 8 ...
-1
votes
1answer
42 views

Is it possible to have collision resistance but not pre-image and 2nd pre-image resistance?

I have studied cryptographic hash functions quite a lot, but have not completely understood whether it is possible to have collision resistance but not pre-image and 2nd pre-image resistance at the ...
1
vote
1answer
48 views

Preimage attack on sum of two Hash functions modulo 2

If a hash function $H$ is defined as $H(x_1,x_2) = H_1(x_1) \oplus H_2(x_2)$ for two n bit good hash functions $H_1$ and $H_2$ then how can we construct a preimage attack on $H$ that is of $O(2^\frac{...
1
vote
1answer
72 views

Is it possible to exploit MD5 weaknesses to create an artificial collision for a password?

If it is possible, could an attacker create a collision for an MD5 password in a database? Could they look at an MD5 hash output and figure out data that creates the same MD5 hash?
2
votes
2answers
348 views

How to unhash sha256? Alternatives to brute force?

I know it's almost impossible to do, SHA256 is a one-way function that can't be easily reversed, just like there are operations that have no reverse, take: $f(x) = x+5$ , it's easy to see that if you ...
1
vote
1answer
77 views

Complexity of Hash mining/signing

While reading about mining in crypto currency, I found that it requires some leading bits of a hash function output to be 0. This boils down to preimage resistance of the hash function, hence done ...
0
votes
0answers
20 views

Public Key Fingerprint: Preimage Resistance

In my system, “resources” are granted operational certificates signed by a particular CA. Each resource has a unique public/private key pair that it generates once. The operational cert granted by the ...
1
vote
1answer
70 views

if a hash function has no known preimage attacks, does that mean there are no known attacks against using it in signatures?

Suppose a hash function like SHA-1 has known collision attacks (including chosen-prefix collision attacks) but no known preimage attacks. Does that mean there are no known attacks against using it in ...
1
vote
1answer
74 views

Attack MD5 with limited input and partial information

If I know that MD5 input is limited to a character set. can I find any information on the input based on the output? example: input consists of 16 character from list of [1,2,3,4,5]. question: based ...
1
vote
0answers
72 views

Does this break the pre-image resistance of the hash function?

Supposing a secure hash function $f(\cdot): \{0,1\}^* \rightarrow \{0,1\}^n$ satisfies pre-image resistance. That is, given a hash value $y$ it should be difficult to find any message $x$ such that $y ...
3
votes
2answers
122 views

Application of cryptographic hash functions which do not require collision resistance property

I can not understand why collision resistance of a cryptographic hash function is not required for some applications. for example, if we store the trusted hash of a file or program, and later when we ...
2
votes
1answer
69 views

What are the “costs” to find a pre-image, weak collision, or strong collision?

For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?
0
votes
0answers
138 views

Does this qualify as a one-way function?

First, we observe that the expression X*Y mod P (where X and Y are secret and P is a large public prime) reveals no useful information. Next we define an extending function E(U, M) which "somehow&...
2
votes
1answer
289 views

Practicality of a certain hash function

Consider the following hash function: $$(V\cdot A + V\cdot B)^2 \bmod C$$ $A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
1
vote
0answers
70 views

Preimage security of combined hash functions

I am struggling with a property of combined hash function and more precisely concatenation. I have seen that concatenating two collision resistant hash functions preserves this property (same for 2nd ...
1
vote
0answers
47 views

Changing a bit in IV of MD5

It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
1
vote
1answer
92 views

finding second pseudo preimage faster than brute force

As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
0
votes
2answers
103 views

Showing a CBC-MAC is not preimage resistant with a proof

So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$. I want to be able to that this won't be preimage ...
1
vote
1answer
39 views

Breaking keyed hash function with half-randomized input

Let's say we have keyed hash function which transforms $256$-bit input into $256$-bit output and the attacker knows the key (let's say the key is $256$-bit long). Now let's consider we will construct ...
3
votes
1answer
194 views

Do hash functions for digital signatures need to be preimage resistant?

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
1
vote
0answers
102 views

Where do hash functions get their preimage resistance?

I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process. Here is the much simpler hash function I ...
3
votes
1answer
187 views

How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
4
votes
2answers
1k views

Are My Answers to This Hash Question Correct?

Question When determining the security of a hash system, the cryptanalyst tries the following attacks. (a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
6
votes
3answers
1k views

Minimum input size of a hash function

This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $...
0
votes
1answer
136 views

How to determine if a hash is pre image resistant or collision free

Let $H : \{0,1\}^*\to \{1,\dots, 2^{256}\}$ be a hash function. Let $p > 2^{256}$ be a safe prime, and $\alpha$ a primitive root for $p$. Define: $$H'(m) = H(m || m),\quad H''(m) = \alpha^{H(m)}\...
1
vote
1answer
104 views

Potential weaknesses when combining hash functions?

For consistency's sake, M is the message, H1 and H2 are separate hash functions. I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and ...
1
vote
1answer
81 views

Could multicollisions be used to mine large amounts of cryptocurrency?

I'm reading about hash functions at the moment, and in the book I'm reading there's a section on multicollisions. Specifically, using a 2-collision to find $2^N$ collisions in $N2^N$ time. If, ...
1
vote
0answers
131 views

"Reversing" SHA256 [duplicate]

Let's say I give you the sha256 hash of my password, which I'll call X. Now, the sha256 algorithm is a one-way function, meaning you can give it some input and get an output, but you can't get the ...
0
votes
0answers
279 views

Is it possible to reverse the final rounds of SHA-256

I've seen a lot of preimage and collision attacks on SHA-256 that target the first few rounds. So far, the best attacks break preimage resistance for the first 52 rounds out of 64 rounds. However, I'...
1
vote
1answer
436 views

Why would this algorithm be vulnerable to a preimage attack?

If I created this algorithm: Break the message $M$ up into $n$ blocks $m_1,\ldots,m_n$ of 512 bits each. Compute the hash by alternating AND and OR operations on the blocks. More specifically: The ...
2
votes
1answer
969 views

For SHA3-512, SHA512, and Whirlpool, which algorithm has least probability for collision and preimage collision?

For comparing these 3 hash functions SHA3-512, SHA512, and Whirlpool. Which one is strongest against collision and preimage attacks. Are they fundamentally the same because of the same size output? ...
2
votes
1answer
134 views

Does double hashing increase resistant against first preimage attacks?

Let's take Bitcoin as an example. Bitcoin uses SHA256, which can be vulnerable to collision and preimage attacks - although this is extremely unlikely to happen in the near-future. However, let's ...
8
votes
1answer
836 views

"official" guidelines about the minimum length of a truncated hash

I am looking for some reference documentation suggesting a minimum reasonable length for a truncated hash (specifically, a truncated SHA-256 hash) to ensure preimage resistance. Obviously, truncating ...
0
votes
1answer
142 views

How safe is my method

I'm building a website. I have an API which takes 2 parameters: delete_user(user_id, hash). And there is method to evaluate hash using SHA512: ...
1
vote
1answer
87 views

Good pre-image resistance value for hash visualization

I want to do "hash visualization", i.e. derive a human-meaningful information from a hash, like a phrase or an avatar. But the current techniques usually don't use many bits, for example tripphrases ...
1
vote
1answer
93 views

Pre-Image Resistance of repeated, patterned SHA2-256 digests

Suppose $H = \operatorname{SHA2-256}$. Let $H_1 = H(\text{“Alpha1”})$. Let $H_2 = H(\text{“Alpha2”})$. … Let $H_N = H(\text{“AlphaN”})$. So all these digests are based off a common pre-image post-...
6
votes
2answers
3k views

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

I found a hashcat benchmark results in the internet: hashcat results: SHA-384 is 17065.4 MH/s SHA-512 is 17280.3 MH/s Why does SHA-512 take less time? SHA-512 is longer and I thought it therefore ...
1
vote
1answer
91 views

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case : ...
12
votes
3answers
2k views

SHA3-255, one bit less

I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
2
votes
1answer
127 views

Cryptographic hash function based on logistic map?

Is there any secure cryptographic hash function based on the logistic map?
3
votes
1answer
89 views

What is the smallest size of the hash output?

Suppose we want to make the hash pre-image resistant to 40 bit security (success chance is $2^{−40}$). What would be the smallest size of the hash output?
3
votes
1answer
50 views

How to get a speedup linear in the number of iterations on unsalted iterated password hashing?

In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ ...
1
vote
1answer
141 views

Are there any homomorphic first and second preimage resistant (cryptographic) hash functions?

Are there any homomorphic cryptographic hash functions that satisfy $\text{H(A + B)} = \text{H(A)} + \text{H(B)}$ which maintaining pre-image resistance
6
votes
3answers
604 views

How to prove that finding a cycle in a cryptographic hash function is hard?

I want to show that finding cycles in a cryptographic hash function is hard. My thought: assume there a black box, that given a cryptographic hash function $h$, finds some $x$ and $r$ in polynomial ...
2
votes
1answer
443 views

Partial Known Message Pre-Image Attack on SHA-1

If the last 448 bits of a sha1 block input are known (only the first 64 bits are unknown). Is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute force all $...
6
votes
2answers
908 views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
-1
votes
1answer
64 views

Add string to create specific MD5?

I have a file that include a long string , I can calc the md5 of this file . Is there any way to know which string I need to add for this file so the md5 of this file will be specific md5 that I want?...
3
votes
2answers
380 views

What do the security definitions of SHA-3 mean, quantitatively?

In the SHA-3 standard (page 31) the security of SHA-3 is defined quantitatively, for example, they are saying SHA3-256 provides 256 bits of preimage resistance. How is this number of bits to be ...
2
votes
1answer
442 views

What is the minimum message length to obtain the full potential of a hash?

Suppose I want to commit to a uniformly picked nonce of fixed length $n$ bits without revealing the nonce, so I use a secure hash function $H$ mapping messages to digests of length $d$ bits. Suppose $...
21
votes
2answers
8k views

What makes SHA-256 secure?

For example, RSA relies on a mathematically hard problem, factoring, while ECDSA or similar rely on discrete logarithm problem. What makes SHA-256 and similar hash functions, of the same family, ...