Questions tagged [sha-256]

SHA-256 is part of the SHA-2 family of hash functions with a 256-bit output and a 128-bit security level.

Filter by
Sorted by
Tagged with
2
votes
1answer
99 views

SHA-256 security for initial 32 bits

I have concerns regarding truncated SHA-256 hashes in an application I am building at the moment: Nomenclature secret - the full 256-bit SHA-256 result of hashing ...
13
votes
5answers
6k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
0
votes
1answer
61 views

Can I find a number, such that the its SHA-256 hash is all-0 [duplicate]

I want to find a number, such that the result of its SHA-256 hash is all 0. I don't know if this number exists.
2
votes
1answer
144 views

Finding the IV values of SHA-256 given all message blocks

Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with ...
2
votes
1answer
85 views

Can we calculate the “previous hash value” in the SHA256 compression function with a known message block and final hash?

Suppose we have a $512$-bit (or $512\times n$ bit) message that we'd like to hash using SHA-256. I've looked at the implementation, and from what I understand, after padding, there will be a total of $...
0
votes
1answer
40 views

AES-256 CTR with ESSIV, is this correct?

I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is: ...
1
vote
1answer
60 views

SHA256 hash malleability

Can an SHA-256 plaintext be malleable? For example: Given $y = hash(x)$ , can an attacker find $z$ so that $z = hash(f(x))$. Here $f()$ might be the addition of a suffix to the message, an XOR ...
0
votes
1answer
44 views

Is it okay to reuse a single symmetric key for a large volume of messages and HMACs, so long as “nonces” are randomly generated for both of them?

https://www.reddit.com/r/crypto/comments/fnku50/nonce_reuse_vs_iv_reuse/ Nonce reuse with the same key is catastrophic to security. The same premise holds for initialization vectors. If the key ...
1
vote
1answer
100 views

Hash based stream cipher where the input is a constant, key, nonce and counter

This is a question out of curiosity ! A hash function produces an output that is considered computationally infeasible to reverse. Let's consider, for the sake of illustration purposes a tried and ...
2
votes
1answer
2k views

FIPS-Compliant SHA2

I want to use SHA-512 for hashing in a system that must be FIPS-compliant. When I look at the FIPS 140 list of approved providers, I don't see SHA from any provider as being an approved algorithm, I ...
10
votes
2answers
9k views

128 bit hash with least chance of collision?

I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
2
votes
2answers
70 views

What is the difference between a PRF and a PRP, and are cryptographic hash functions the same as HMAC (PRFs or PRPS)?

I read one answer to a similar question that put forth that a hash function is distinct from a PRF, however I've also found materials purporting that cryptographic hash functions are PRFs, and I'm not ...
0
votes
0answers
29 views

Is Joux's multicollision attack applicable for truncated SHA256?

Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf ...
0
votes
0answers
40 views

Should I update my fedora encrypted system?

I have installed my Fedora Workstation version 23 using native disk encryption. Since it, I am upgrading it using dnf system-upgrade plugin. Today, I have fedora 32. Some time ago, I’ve discovered ...
5
votes
1answer
2k views

Is SHA-1 secure when used to implement a PRNG

I read SHA-1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new ...
0
votes
1answer
37 views

SHA-256 for unique token

I need to create an unique token for a web service. I'm doing that in the following in the following way: ...
0
votes
1answer
69 views

SHA-256 Hashing Functionality

It seems all these options are correct to me fingerprint of the provided input. A one-way deterministic hash function. symmetric hash function A hash function that generates a digest. ...
12
votes
2answers
1k views

The effect of truncated hash on entropy

Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
6
votes
3answers
464 views

How to prove that finding a cycle in a cryptographic hash function is hard?

I want to show that finding cycles in a cryptographic hash function is hard. My thought: assume there a black box, that given a cryptographic hash function $h$, finds some $x$ and $r$ in polynomial ...
61
votes
5answers
47k views

SHA512 faster than SHA256?

I'm getting this strange result that SHA512 is around 50% faster than SHA256. I'm using .net's SHA512Managed and SHA256Managed ...
0
votes
1answer
38 views

Can we use a hash-based stream cipher against DPA attacks?

There have been lots of DPA researches against block ciphers. I was wondering if we use a cryptographically secure hash of an incremental counter as a stream cipher, will it withstand DPA attacks? ...
0
votes
2answers
67 views

For uniterated SHA-256 of salted password, should the password precede the salt?

This is a follow-up to this question (thanks to answers from @fgrieu and @kelalaka ) about the format of a salt when hashing a salted password. I realize this is pretty much academic, as the proposed ...
1
vote
2answers
137 views

What format should a salt be when it is concatenated with the password?

Assume that, in the available environment, it is not possible to use modern password hashing functions (bcrypt, scrypt, Argon2, PBKDF2, etc.), so it is necessary to roll my own stand-in, until they ...
0
votes
0answers
77 views

Combining Hashes - NTLM and SHA

i have been recently learning about different types of hashing and the encryption/decryption methods of such hashes. Im currently trying to find the preimage of this hash i have been given as a ...
2
votes
0answers
18 views

How to find k-way second preimages

For example: Assuming someone has found a second preimage for SHA-256. In other words, for SHA256(M1)=H, someone has found M2 which SHA256(M2)=H Now, is it possible to generate k-way second ...
2
votes
1answer
99 views

Random oracle based on SHA-256

I am given the following problem. Consider SHA-256 to be a random oracle in a practical application. Construct an (almost) random oracle $\{0,1\}^*→\{0,1\}^{3000}$ based on SHA-256. Does it mean ...
0
votes
0answers
54 views

Is it possible to reverse the final rounds of SHA-256

I've seen a lot of preimage and collision attacks on SHA-256 that target the first few rounds. So far, the best attacks break preimage resistance for the first 52 rounds out of 64 rounds. However, I'...
1
vote
0answers
61 views

“Reversing” SHA256 [duplicate]

Let's say I give you the sha256 hash of my password, which I'll call X. Now, the sha256 algorithm is a one-way function, meaning you can give it some input and get an output, but you can't get the ...
0
votes
1answer
114 views

Understanding example of ECDSA P256

I am new to cryptography, I found the below Example on a nice website, but I am not able to understand the most of the terms used (H:Hash, K:Random number,E=?, Kinv=?,Rx=?=RY?,R=Private key?,D?,S? ...
2
votes
0answers
49 views

Is there a reason behind the number of bit rotations used in SHA-256?

SHA-256 uses the following bitwise functions during the hash algorithm: $$\begin{align*} \Sigma_0^{\{256\}}(x)&=\operatorname{ROTR}^{ 2}(x)\oplus\operatorname{ROTR}^{13}(x)\oplus\operatorname{...
1
vote
2answers
138 views

521-bit ECC keys are the same strength as RSA 15,360-bit keys

521 bit ECC uses key sizes 7.5 times smaller than the RSA standard while offering encryption that is magnitudes more secure. An RSA 2048-bit key's secure enough for banking, but a 521-bit ECC key is ...
0
votes
0answers
67 views

How to bruteforce password from HMAC-SHA256 hash (if you have the key)?

Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), ...
0
votes
1answer
62 views

Xor'ing sha256 words instead of adding

In sha-256, when the words go through the compression function, they get added to the previous hash. In case of the first 64 rounds, they get added to the initial words ($\bmod 2^{32}$ of course). ...
0
votes
1answer
52 views

Pre-Image Resistance of repeated, patterned SHA2-256 digests

Suppose $H = \operatorname{SHA2-256}$. Let $H_1 = H(\text{“Alpha1”})$. Let $H_2 = H(\text{“Alpha2”})$. … Let $H_N = H(\text{“AlphaN”})$. So all these digests are based off a common pre-image post-...
0
votes
2answers
150 views

How to pad a 448 bit message for SHA256?

I recently implemented a very simple SHA256 hashing program in C++, since the SHA256 hash function's block size is 512 bits or 64 bytes, and messages less than that size have to be padded as per the ...
3
votes
1answer
63 views

If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
0
votes
0answers
17 views

Does every 256 bit number have a distinct sha256 result? [duplicate]

If I were some how able to create a table of all 256 bit inputs and outputs of sha256, would each of the inputs have a distinct output?
4
votes
2answers
1k views

Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?

I'd expect a 192-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 192-bit nonce and ...
1
vote
1answer
51 views

Can I retrieve a re-hashed (hash) value, for instance by additional hashing?

I have a double-SHA-256 of some text $$ h_2 = \operatorname{SHA256}(\operatorname{SHA256}(m)).$$ I don't need the plain text ($m$), but somehow I need to get first $$h_1 = \operatorname{SHA256}(m).$$ ...
1
vote
1answer
76 views

If I concatenate two colliding SHA-256 messages with the same prefix and suffix, will the resulting hash output still collide with each other?

So let's say that there are two messages, $x_1$ and $x_2$, which hash to the same output. In other words, these two messages collide with each other: $$\operatorname{SHA256}(x_1)=\operatorname{SHA256}...
1
vote
1answer
138 views

Problem understanding SHA-256

I'm reading this paper: fips180-4-draft-aug2014 I'm on page 23 where they have two values for SHA-256: T1 and T2. While I understand the operations done, I don't understand the bigger picture. Why ...
1
vote
0answers
47 views

Does fixing partial bits of a SHA256 hash increase the probability of finding a preimage using the meet-in-the-middle attack?

Let’s say I want to find a partial rather than full preimage using the meet-in-the-middle attack. For example, my goal is to find a preimage so that the first 76-bit output of the hash are all ...
2
votes
1answer
377 views

Is it possible to guarantee a SHA-256 hash will begin with a certain 3 bytes?

I've found this online currency someone has built as a project and it's "miner" / Proof of Work algorithm is as follows: Generate 32 bytes of random data and hash it, store the original value and the ...
1
vote
1answer
48 views

Difference between MAC(key, msg) and SHA(key || msg)

I know that SHA(key || msg) is vulnerable to string concatenation attack. However, what if we specified key bit-length and msg bit-length? For example, key bit-length is 256 bit and msg bit-length is ...
1
vote
1answer
128 views

Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?

There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm. I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure ...
6
votes
5answers
951 views

Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?
2
votes
1answer
85 views

Does double hashing increase resistant against first preimage attacks?

Let's take Bitcoin as an example. Bitcoin uses SHA256, which can be vulnerable to collision and preimage attacks - although this is extremely unlikely to happen in the near-future. However, let's ...
8
votes
1answer
477 views

“official” guidelines about the minimum length of a truncated hash

I am looking for some reference documentation suggesting a minimum reasonable length for a truncated hash (specifically, a truncated SHA-256 hash) to ensure preimage resistance. Obviously, truncating ...
2
votes
1answer
239 views

Hash function and Digital Encryption Algorithm

I am familiar with the fundamentals of cryptography as well as Digital Signatures. I understand how DSA like RSA works and the fundamentals of mathematics behind digital signing and verification. I ...
5
votes
3answers
522 views

Does knowledge of SHA256(secret ∥ known constant) in addition to SHA256(secret) give any information about the secret?

Does knowledge of SHA256(secret) and SHA256(secret ∥ known constant) give any more information about the secret than just knowledge of SHA256(secret)?

1
2 3 4 5
9