Questions tagged [sha-256]
SHA-256 is part of the SHA-2 family of hash functions with a 256-bit output and a 128-bit security level.
589
questions
2
votes
0
answers
192
views
Is there a reason behind the number of bit rotations used in SHA-256?
SHA-256 uses the following bitwise functions during the hash algorithm:
$$\begin{align*}
\Sigma_0^{\{256\}}(x)&=\operatorname{ROTR}^{ 2}(x)\oplus\operatorname{ROTR}^{13}(x)\oplus\operatorname{...
- 63
3
votes
1
answer
319
views
Random oracle based on SHA-256
I am given the following problem.
Consider SHA-256 to be a random oracle in a practical application.
Construct an (almost) random oracle $\{0,1\}^*→\{0,1\}^{3000}$ based on SHA-256.
Does it mean ...
0
votes
0
answers
444
views
Is it possible to reverse the final rounds of SHA-256
I've seen a lot of preimage and collision attacks on SHA-256 that target the first few rounds. So far, the best attacks break preimage resistance for the first 52 rounds out of 64 rounds.
However, I'...
- 143
5
votes
1
answer
11k
views
Understanding example of ECDSA P256
I am new to cryptography, I found the below Example on a nice website, but I am not able to understand the most of the terms used (H:Hash, K:Random number,E=?, Kinv=?,Rx=?=RY?,R=Private key?,D?,S? ...
- 63
3
votes
2
answers
4k
views
521-bit ECC keys are the same strength as RSA 15,360-bit keys
521 bit ECC uses key sizes 7.5 times smaller than the RSA standard while offering encryption that is magnitudes more secure. An RSA 2048-bit key's secure enough for banking, but a 521-bit ECC key is ...
- 31
0
votes
0
answers
986
views
How to bruteforce password from HMAC-SHA256 hash (if you have the key)?
Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), ...
- 1
0
votes
1
answer
321
views
Xor'ing sha256 words instead of adding
In sha-256, when the words go through the compression function, they get added to the previous hash. In case of the first 64 rounds, they get added to the initial words ($\bmod 2^{32}$ of course). ...
- 337
1
vote
2
answers
2k
views
How to pad a 448 bit message for SHA256?
I recently implemented a very simple SHA256 hashing program in C++, since the SHA256 hash function's block size is 512 bits or 64 bytes, and messages less than that size have to be padded as per the ...
- 1,000
2
votes
1
answer
997
views
SHA-256 security for initial 32 bits
I have concerns regarding truncated SHA-256 hashes in an application I am building at the moment:
Nomenclature
secret - the full 256-bit SHA-256 result of hashing ...
4
votes
1
answer
298
views
If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?
The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
- 153
4
votes
2
answers
1k
views
Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?
I'd expect a 192-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 192-bit nonce and ...
1
vote
1
answer
138
views
Can I retrieve a re-hashed (hash) value, for instance by additional hashing?
I have a double-SHA-256 of some text $$ h_2 = \operatorname{SHA256}(\operatorname{SHA256}(m)).$$ I don't need the plain text ($m$), but somehow I need to get first $$h_1 = \operatorname{SHA256}(m).$$
...
- 13
1
vote
1
answer
429
views
If I concatenate two colliding SHA-256 messages with the same prefix and suffix, will the resulting hash output still collide with each other?
So let's say that there are two messages, $x_1$ and $x_2$, which hash to the same output. In other words, these two messages collide with each other:
$$\operatorname{SHA256}(x_1)=\operatorname{SHA256}...
- 153
1
vote
1
answer
520
views
Problem understanding SHA-256
I'm reading this paper: fips180-4-draft-aug2014
I'm on page 23 where they have two values for SHA-256: T1 and T2. While I understand the operations done, I don't understand the bigger picture. Why ...
Janko64
1
vote
0
answers
117
views
Does fixing partial bits of a SHA256 hash increase the probability of finding a preimage using the meet-in-the-middle attack?
Let’s say I want to find a partial rather than full preimage using the meet-in-the-middle attack. For example, my goal is to find a preimage so that the first 76-bit output of the hash are all ...
- 153
1
vote
1
answer
181
views
Difference between MAC(key, msg) and SHA(key || msg)
I know that SHA(key || msg) is vulnerable to string concatenation attack. However, what if we specified key bit-length and msg bit-length? For example, key bit-length is 256 bit and msg bit-length is ...
- 13
2
votes
1
answer
369
views
Finding the IV values of SHA-256 given all message blocks
Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with ...
- 23
2
votes
1
answer
272
views
Does double hashing increase resistant against first preimage attacks?
Let's take Bitcoin as an example. Bitcoin uses SHA256, which can be vulnerable to collision and preimage attacks - although this is extremely unlikely to happen in the near-future.
However, let's ...
- 153
8
votes
1
answer
1k
views
"official" guidelines about the minimum length of a truncated hash
I am looking for some reference documentation suggesting a minimum reasonable length for a truncated hash (specifically, a truncated SHA-256 hash) to ensure preimage resistance.
Obviously, truncating ...
- 181
1
vote
2
answers
815
views
Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?
There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm.
I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure ...
- 211
0
votes
1
answer
134
views
Does hashing a hash of a password over and over again increase its security?
I've heard of password cracking attacks using a list of commonly used passwords. Suppose in my situation, I can never be sure about the strength of the password, that a user inputs to my interface. So ...
- 1,000
11
votes
1
answer
818
views
Minimizing exchanges for ZK proof of a message with given SHA-256
Consider the problem of proving knowledge of a message $m$ which has a certain public SHA-256 hash $h$, without disclosing $m$ or usable information about it, while minimizing the information exchange ...
- 138k
1
vote
1
answer
33
views
Does concatinating mutliple digests of hashes from CSRN result in a CSRN?
Kind of a noob question. Suppose;
We generate 1,000 cryptographic-ally secure random numbers & store each of them in an array1.
For each number in this array1, we take the hash sha256(CSRN) then ...
- 145
2
votes
1
answer
4k
views
What is the use of encoding a hash output?
In many applications, the MD5 algorithm is used which produces a 128-bit output which is represented as a sequence of 32 hexadecimal digits.
This output is further encoded using a base62 or base64 ...
- 45
2
votes
1
answer
262
views
Partial key reveal for SHA-256 hash
Let's say I have a message 0123456789abcdefghijklmnopqrstuvwxyz which gives me the SHA-256 hash ...
- 624
1
vote
0
answers
221
views
Idea behind internal SHA-2 functions
In the SHA-2 family, specifically SHA-256, there are functions called Sigma0 and Sigma1, which look like this:
...
- 337
2
votes
1
answer
167
views
Is iterative sha256 adequate for local password manager?
I'm fairly entry-level crypto; not a cryptographer by any stretch... I am at the level of ability to implement most of the traditional packages in python; the hashlib hashes and EAS, ECDSA ...
- 121
5
votes
2
answers
375
views
"One-Wayness" of SHA 1
I recently started learning about Hash Functions for my first time, and I've gone through and have tried to understand the SHA1 process.
Brilliant does an excellent job of explaining it step by step.
...
- 151
2
votes
2
answers
3k
views
Read the result of the hash by SHA-256 as a number
I want to read the full output hash of SHA-256 as a number. How I can do it? Is it in the range of 0 to 2^256?
- 45
6
votes
1
answer
471
views
Do a 160-bit SHA-1 hash and a 160-bit slice of a SHA-256 hash have the same strength in terms of collision-free?
Take OpenPGP fingerprint for example. If the 40-digit hex standard remains unchanged, would it be helpful to upgrade SHA-1 to SHA-256 (but only taking the last 160 bits), in terms of reducing the risk ...
- 161
0
votes
1
answer
1k
views
SHA256 output to 1-6 number range?
I want to calculate a random number (1 to 6) from the output of sha256. Can I assurance the probability of 6 abilities is the same?
- 45
0
votes
2
answers
638
views
If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?
In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
- 103
5
votes
2
answers
371
views
If a new hash function were made that simply truncated sha-256 to the first N bits, how much insight would it provide into sha-256?
Clearly it would provide perfect insight if all 256 bits were used. What about if 255 were used? Would the general behavior and properties of "sha-255" be expected to be close to sha-256? What about "...
- 177
2
votes
2
answers
232
views
Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?
Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
- 177
1
vote
1
answer
383
views
are there more efficient methods than HMAC to achieve convergent encryption?
I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
- 125
6
votes
2
answers
623
views
Entropy preservation through cryptographic hash function
Background
First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
- 177
2
votes
1
answer
114
views
Pre-Image Resistance of repeated, patterned SHA2-256 digests
Suppose $H = \operatorname{SHA2-256}$.
Let $H_1 = H(\text{“Alpha1”})$.
Let $H_2 = H(\text{“Alpha2”})$.
…
Let $H_N = H(\text{“AlphaN”})$.
So all these digests are based off a common pre-image post-...
0
votes
1
answer
82
views
Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?
When aiming to build a MAC, classic literature discusses the use of Envelopes or key "Sandwich" to build MACs. These were proved to be as secure as HMAC in “Sandwich” Is Indeed Secure: How to ...
1
vote
0
answers
84
views
Can I prove that hash of modified preimage is valid
Assume that hash(X) == Y
Alice knows both X and Y
Bob only knows Y
Alice generates a random nonce N and shares it with Bob.
Alice calculates H = hash(X⊕N) and shares H with Bob.
Can Alice prove to ...
- 111
0
votes
1
answer
2k
views
Is there a SHA-256 value which hashes to itself? [duplicate]
Getting curious about SHA-256 cycles (what happens if you hash a value repeatedly), I came across this question:
Cycles in SHA256
The first answer suggests that using a 7-bit hash, it's possible to ...
- 173
3
votes
1
answer
2k
views
Why does LastPass use exactly 100100 PBKDF2 rounds
LastPass encryption scheme is recently changed to use more PBKDF2 rounds, specifically 100100. This seems like a really weird number choose. From what I understand brute force time scales linearly ...
1
vote
0
answers
292
views
KCV scheme that encrypts a hash over key and IV
Is there anything wrong with this key-check value scheme?
This question is a follow-up to an earlier question of mine. In summary, I want to devise a key-check value scheme that will enable my ...
- 329
9
votes
1
answer
3k
views
Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256
In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest):
Level I: ...
- 167
0
votes
1
answer
168
views
Hashing high entropy key into AES format
If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
- 613
1
vote
1
answer
1k
views
SHA-256 : Finding two strings that the first n bits of hash value are same [duplicate]
How can I find two strings that have the same hash value for first $n$ bits in SHA-256? I'm implementing it by Python and I have the following ideas and problems:
Keep generating two random string
...
- 13
4
votes
1
answer
221
views
How were the arbitrary values used inside SHA-256 determined?
As I study SHA-256, I wonder how the values inside the algorithm were determined.
Take a look, for example, at how the 16-64th Words are generated. (in Java language)
...
- 43
1
vote
3
answers
4k
views
CRC32 catches errors, but then what's the point of SHA?
If crc or CRC32 is specially designed to catch errors, then what's the point of SHA or md4-5 or any other hashing function? What I did was, I had a 190 mb png file (rendered in 16k resolution with ...
- 337
1
vote
1
answer
687
views
Rationale of the SHA-256 sigma function definitions
When the sigma functions are defined in equations (4.4) and (4.5) in FIPS PUB 180-4, the defined functions show the traditional sigma summation symbol, with limits 0 to {256} and 1 to {256}. The ...
- 113
3
votes
2
answers
3k
views
Would SHA-256(SHA-256(x)) produce collisions?
Was reviewing some Bitcoin public-key hash literature and the use of RIPEMD-160 and the SHA-256 as below:
RIPEMD160(SHA256(ECDSA_publicKey))
The Proof-of-work ...
1
vote
1
answer
1k
views
Is SHA256 resistant to second preimage attack?
I am looking into building a merkle tree algorithm and I need to know if SHA256 is resistant to second preimage attack.
- 11