Questions tagged [preimage-resistance]

Difficulty of finding an input string that hashes to a given value

Filter by
Sorted by
Tagged with
0
votes
0answers
131 views

Does this qualify as a one-way function?

First, we observe that the expression X*Y mod P (where X and Y are secret and P is a large public prime) reveals no useful information. Next we define an extending function E(U, M) which "somehow&...
-3
votes
0answers
56 views

Viability of sum-based hashing

In a previous post I made an admittedly laughable attempt to construct a straightforward number-theoretic hash function. This time around I decided to use a bit more opaque approach: sums. The ...
2
votes
1answer
277 views

Practicality of a certain hash function

Consider the following hash function: $$(V\cdot A + V\cdot B)^2 \bmod C$$ $A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the ...
1
vote
0answers
52 views

Preimage security of combined hash functions

I am struggling with a property of combined hash function and more precisely concatenation. I have seen that concatenating two collision resistant hash functions preserves this property (same for 2nd ...
1
vote
0answers
32 views

Changing a bit in IV of MD5

It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
1
vote
1answer
59 views

finding second pseudo preimage faster than brute force

As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I ...
0
votes
2answers
71 views

Showing a CBC-MAC is not preimage resistant with a proof

So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$. I want to be able to that this won't be preimage ...
1
vote
1answer
34 views

Breaking keyed hash function with half-randomized input

Let's say we have keyed hash function which transforms $256$-bit input into $256$-bit output and the attacker knows the key (let's say the key is $256$-bit long). Now let's consider we will construct ...
3
votes
1answer
98 views

Do hash functions for digital signatures need to be preimage resistant?

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" ...
1
vote
0answers
90 views

Where do hash functions get their preimage resistance?

I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process. Here is the much simpler hash function I ...
3
votes
1answer
81 views

How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
4
votes
2answers
1k views

Are My Answers to This Hash Question Correct?

Question When determining the security of a hash system, the cryptanalyst tries the following attacks. (a) If the attacker is NOT allowed to modify the original message, determine the number of hash ...
6
votes
3answers
867 views

Minimum input size of a hash function

This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $...
0
votes
1answer
77 views

How to determine if a hash is pre image resistant or collision free

Let $H : \{0,1\}^*\to \{1,\dots, 2^{256}\}$ be a hash function. Let $p > 2^{256}$ be a safe prime, and $\alpha$ a primitive root for $p$. Define: $$H'(m) = H(m || m),\quad H''(m) = \alpha^{H(m)}\...
1
vote
1answer
83 views

Potential weaknesses when combining hash functions?

For consistency's sake, M is the message, H1 and H2 are separate hash functions. I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and ...
1
vote
1answer
59 views

Could multicollisions be used to mine large amounts of cryptocurrency?

I'm reading about hash functions at the moment, and in the book I'm reading there's a section on multicollisions. Specifically, using a 2-collision to find $2^N$ collisions in $N2^N$ time. If, ...
1
vote
0answers
66 views

“Reversing” SHA256 [duplicate]

Let's say I give you the sha256 hash of my password, which I'll call X. Now, the sha256 algorithm is a one-way function, meaning you can give it some input and get an output, but you can't get the ...
0
votes
0answers
113 views

Is it possible to reverse the final rounds of SHA-256

I've seen a lot of preimage and collision attacks on SHA-256 that target the first few rounds. So far, the best attacks break preimage resistance for the first 52 rounds out of 64 rounds. However, I'...
1
vote
1answer
424 views

Why would this algorithm be vulnerable to a preimage attack?

If I created this algorithm: Break the message $M$ up into $n$ blocks $m_1,\ldots,m_n$ of 512 bits each. Compute the hash by alternating AND and OR operations on the blocks. More specifically: The ...
2
votes
1answer
324 views

For SHA3-512, SHA512, and Whirlpool, which algorithm has least probability for collision and preimage collision?

For comparing these 3 hash functions SHA3-512, SHA512, and Whirlpool. Which one is strongest against collision and preimage attacks. Are they fundamentally the same because of the same size output? ...
2
votes
1answer
103 views

Does double hashing increase resistant against first preimage attacks?

Let's take Bitcoin as an example. Bitcoin uses SHA256, which can be vulnerable to collision and preimage attacks - although this is extremely unlikely to happen in the near-future. However, let's ...
8
votes
1answer
614 views

“official” guidelines about the minimum length of a truncated hash

I am looking for some reference documentation suggesting a minimum reasonable length for a truncated hash (specifically, a truncated SHA-256 hash) to ensure preimage resistance. Obviously, truncating ...
0
votes
1answer
135 views

How safe is my method

I'm building a website. I have an API which takes 2 parameters: delete_user(user_id, hash). And there is method to evaluate hash using SHA512: ...
1
vote
1answer
82 views

Good pre-image resistance value for hash visualization

I want to do "hash visualization", i.e. derive a human-meaningful information from a hash, like a phrase or an avatar. But the current techniques usually don't use many bits, for example tripphrases ...
0
votes
1answer
59 views

Pre-Image Resistance of repeated, patterned SHA2-256 digests

Suppose $H = \operatorname{SHA2-256}$. Let $H_1 = H(\text{“Alpha1”})$. Let $H_2 = H(\text{“Alpha2”})$. … Let $H_N = H(\text{“AlphaN”})$. So all these digests are based off a common pre-image post-...
6
votes
2answers
3k views

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

I found a hashcat benchmark results in the internet: hashcat results: SHA-384 is 17065.4 MH/s SHA-512 is 17280.3 MH/s Why does SHA-512 take less time? SHA-512 is longer and I thought it therefore ...
1
vote
1answer
77 views

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case : ...
12
votes
3answers
2k views

SHA3-255, one bit less

I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
2
votes
1answer
101 views

Cryptographic hash function based on logistic map?

Is there any secure cryptographic hash function based on the logistic map?
3
votes
1answer
84 views

What is the smallest size of the hash output?

Suppose we want to make the hash pre-image resistant to 40 bit security (success chance is $2^{−40}$). What would be the smallest size of the hash output?
3
votes
1answer
49 views

How to get a speedup linear in the number of iterations on unsalted iterated password hashing?

In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ ...
1
vote
1answer
121 views

Are there any homomorphic first and second preimage resistant (cryptographic) hash functions?

Are there any homomorphic cryptographic hash functions that satisfy $\text{H(A + B)} = \text{H(A)} + \text{H(B)}$ which maintaining pre-image resistance
6
votes
3answers
502 views

How to prove that finding a cycle in a cryptographic hash function is hard?

I want to show that finding cycles in a cryptographic hash function is hard. My thought: assume there a black box, that given a cryptographic hash function $h$, finds some $x$ and $r$ in polynomial ...
2
votes
1answer
331 views

Partial Known Message Pre-Image Attack on SHA-1

If the last 448 bits of a sha1 block input are known (only the first 64 bits are unknown). Is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute force all $...
5
votes
1answer
678 views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
-1
votes
1answer
60 views

Add string to create specific MD5?

I have a file that include a long string , I can calc the md5 of this file . Is there any way to know which string I need to add for this file so the md5 of this file will be specific md5 that I want?...
3
votes
2answers
343 views

What do the security definitions of SHA-3 mean, quantitatively?

In the SHA-3 standard (page 31) the security of SHA-3 is defined quantitatively, for example, they are saying SHA3-256 provides 256 bits of preimage resistance. How is this number of bits to be ...
2
votes
1answer
252 views

What is the minimum message length to obtain the full potential of a hash?

Suppose I want to commit to a uniformly picked nonce of fixed length $n$ bits without revealing the nonce, so I use a secure hash function $H$ mapping messages to digests of length $d$ bits. Suppose $...
20
votes
2answers
7k views

What makes SHA-256 secure?

For example, RSA relies on a mathematically hard problem, factoring, while ECDSA or similar rely on discrete logarithm problem. What makes SHA-256 and similar hash functions, of the same family, ...
1
vote
1answer
41 views

Number of preimages of hash function from bounded domain

Suppose we have an "ideal" cryptographic hash function $H: \{0,1\}^{n+k}\to \{0,1\}^{n}$ and a given bitstring $b\in \{0,1\}^{n}$, Can we estimate how many preimages $H^{-1}(b)$ there are? With ...
0
votes
1answer
162 views

What pieces of information do you need to unhash a key to find out the original message?

I am very new to the hashing world and despite hours of research (AKA Googling) I still don't understand this piece of information. What are the different pieces of information that are needed in ...
2
votes
0answers
230 views

Is the concatenation of one-way compression functions one-way?

Given two independently keyed compression functions $h_1$ and $h_2$: $h_b(x): \{0,1\}^{3n} \to \{0,1\}^{n}$, where $b \in \{1,2\}$. Let $h(x) = h_1(x) \| h_2(x)$. Given at least one of $h_1$ and $...
4
votes
2answers
663 views

If you wrote a reversible SHA-256 algorithm, how many “metadata” bits would be required for reversability?

I was reading about reversible computing while thinking about FPGA circuits. I realized that it would be possible to write a reversible SHA-256 algorithm if you stored some additional information as "...
17
votes
1answer
4k views

What are the consequences of removing a single byte from a sha256 hash?

I'm working on a system (Ethereum) where it is significantly cheaper to store 32 bytes than 33 bytes. I'd like to create a table where data is stored based on its hash. Sha256 would meet this ...
53
votes
11answers
18k views

How do hashes really ensure uniqueness?

This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup. So hashes are said ...
2
votes
1answer
388 views

Hashing based on the discrete logarithm problem

At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup). Additionally, $H(x)$ ...
1
vote
0answers
48 views

Hash Function SHA-3 [duplicate]

I would like to discuss the minimum input of hash function to consider strong (e.g Shack128 (SHA-3)). I have a mechanism based on SHA-3, but the input is just 40-bit, some friends told me 40-bit input ...
3
votes
1answer
626 views

How is pre-image resistance defined, formally?

Earlier today, forest asked in our chat, The Side Channel whether the definition of first pre-image security actually requires that an input that evaluates to the challenge hash result must be known ...
0
votes
2answers
175 views

Security of password hash with known prefix and appendix

Assume I have a password that is exactly 32 characters long. I hash it the following way: Prepend 1524 bytes (known to an attacker) Append 3356 bytes (known to an attacker) Do the checksum It is ...
3
votes
1answer
88 views

Security implications of slow-by-design hashes on relative security vs. hash size

Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design? Example: let's say you want 128-bit hashes. This is ...