Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
22 votes
Accepted

Why is Pearson hash not used as a cryptographic hash?

Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ...
CodesInChaos's user avatar
  • 24.9k
19 votes

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

The only differences in calculations are the initial value and the output size. From NIST FIPS 180-4 The initial hash value, $H^{(0)}$, shall be set as specified in Sec. 5.3.4; and The 384-bit ...
kelalaka's user avatar
  • 48.7k
18 votes
Accepted

SHA3-255, one bit less

With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit ...
Gilles 'SO- stop being evil''s user avatar
12 votes

Why is Pearson hash not used as a cryptographic hash?

Because it is not secure enough. Hash functions rely a lot on diffusion (a single bit change must change half of the other bits) and confusion (the value of a bit should depend on the value of other ...
Biv's user avatar
  • 9,988
8 votes

collisions on hash functions

It's harder for the designer to make a hash function collision-resistant than second-preimage-resistant, because it's harder for the adversary to find a second preimage than to find a collision.
Squeamish Ossifrage's user avatar
8 votes

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Any hash function? Yes, certainly. In fact, most hash functions are not even designed to be resistant to preimage attacks. This includes CRCs and standard checksums like Fletcher. Creating preimages ...
forest's user avatar
  • 15.3k
8 votes

How can I determine if a hash function is secure?

The best way to approach problems like this is to start by assuming that a simple solution exists. That assumption might be wrong, of course, but: since this is a textbook problem, it probably does ...
Ilmari Karonen's user avatar
7 votes
Accepted

Why do different applications of hash functions demand different properties of the hash function?

Hash + digital signature If the hash is not collision resistant, the attacker can produce two messages having the same hash. They'll request a signature on the first and present the signature on the ...
CodesInChaos's user avatar
  • 24.9k
7 votes
Accepted

Computational requirements for breaking SHA-256?

First of all, are my assumptions above correct? What would the complexity of the three attacks be? I am also curious what "unit" a number like $2^{256}$ implies - is it something like ...
dusk's user avatar
  • 1,175
7 votes
Accepted

Difference between second pre-image resistance attack and collision attack

You are mistaken. A collision attack is where you need to find any $x$ and $y$ such that $hash(x)=hash(y)$. Thus, you have much more freedom in finding the collision. This makes it "easier" for the ...
Yehuda Lindell's user avatar
7 votes
Accepted

Are My Answers to This Hash Question Correct?

What needs to be memorized in applied science (physics, crypto) is not a set of formulas. It's, for a few of the simplest formulas studied: what the formula yields, for what inputs, the units for ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

Practicality of a certain hash function

The obvious weakness when one sees a square is $$(a)^{2} = (-a)^{2},$$ This is not a problem in the Rabin Cryptosystem since it requires an additional mechanism to resolve the message from possible 4 ...
kelalaka's user avatar
  • 48.7k
6 votes

SHA3-255, one bit less

Apart from the slightly reduced resistances, there is no problem: Resistances for SHA3-512; Pre-image resistance decreased to $2^{511}$ or $2^{504}$, if 1 bit or 1 byte trimmed, respectively. ...
kelalaka's user avatar
  • 48.7k
6 votes
Accepted

Hashing based on the discrete logarithm problem

A secure hash function based on the discrete log problem is $H(x\|y)=x\cdot G+y\cdot P$, where $P$ is a random point for which the discrete log is not known and "$\|$" denotes concatenation; this was ...
Yehuda Lindell's user avatar
6 votes
Accepted

Winternitz One time signature security

W-OTS+ is stronger, as it makes weaker assumptions on the hash function. Let us take a rather extreme example, let us consider W-OTS and W-OTS+ based on the MD5 hash function. Now, the proof for W-...
poncho's user avatar
  • 148k
6 votes
Accepted

Why this isn't second preimage resistance?

Using the hash function; $$h(M) = \operatorname{AES-Enc}\big(M[0\ldots n], M[(n+1)\ldots 2n]\big) \oplus M[0\ldots n]$$ One can find many pre-images with the given hash value $h$ take arbitrary $M[0\...
kelalaka's user avatar
  • 48.7k
5 votes

Computational requirements for breaking SHA-256?

brute-forcing a preimage (..) should take $2^{255}$ trials (half of the hash space). However most refer to $2^{256}$, is that because that means certain success rather than expected time needed? The ...
fgrieu's user avatar
  • 142k
5 votes
Accepted

Difficulty of collision vs preimage vs second-preimage attacks

For a $n$-bit ideal hash: Finding a collision is expected to require a little above $2^{n/2}$ hashes, in short because after having computed $m$ hashes, there are $m(m-1)/2$ opportunities of ...
fgrieu's user avatar
  • 142k
4 votes
Accepted

usefulness of a collision attack that's not also a 2nd pre-image attack

What would be the usefulness of a pure collision attack where you have no control over $m$ or $m'$? One example is when $m$ and $m'$ are or contain randomly selected material. If they're using ...
Luis Casillas's user avatar
4 votes
Accepted

Security implications of slow-by-design hashes on relative security vs. hash size

You CAN get away with using less memory if the hash is expensive. However, that does not mean you should, and it would rarely make any sense. So why would you try to "get away with" using smaller ...
Jacob H's user avatar
  • 364
4 votes

Are My Answers to This Hash Question Correct?

You're wrong. Hint: a value of 8 bits has 256 possible values, not 8.
poncho's user avatar
  • 148k
4 votes
Accepted

What are the “costs” to find a pre-image, weak collision, or strong collision?

In 2004 paper, Rogaway and Shrimpton gave reference to Merkle's paper 1998 : One Way Hash Functions and DES and they Merkle's definitions simply as Contemporaneously, Merkle [10] describes notions ...
kelalaka's user avatar
  • 48.7k
3 votes

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

Why does SHA-512 take less time? Not for cryptographically relevant reasons. Only examination of the code (source, perhaps object) could tell. Essentially, SHA-384 is SHA-512 with a different ...
fgrieu's user avatar
  • 142k
3 votes

SHA3-255, one bit less

Lets get one thing out of the way: forcing one bit to 0 or 1 does not change the output size of the hash. A hash output is not a number, so the output size would not be affected. Reducing hash output ...
Maarten Bodewes's user avatar
  • 92.9k
3 votes

Hash-based signature scheme XMSS/LMS susceptible to preimage/second preimage attack?

I'll first recall the security notions used for signatures and those used for hashes, and then try to answer your question. The building blocks For signature schemes, we try to have "existential ...
Lery's user avatar
  • 7,699
3 votes
Accepted

Unhash possible? How got this user the unhash?

You misread the question; First off, I know hashes are 1 way. There are an infinite number of inputs that can result in the same hash output. Why can't we take a hash and convert it to an equivalent ...
kelalaka's user avatar
  • 48.7k
2 votes
Accepted

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The XMSS Internet Draft actually does not implement the original XMSS scheme but XMSS-T as described in Mitigating Multi-Target Attacks in Hash-based Signatures, by Hülsing, Rijneveld, and Song (PKC ...
mephisto's user avatar
  • 2,908
2 votes
Accepted

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

There are no known attacks on SHA3 series that are faster than the generic attacks. Your problem is the 2nd pre-image attack: given a message $m_1$ finding another message $m_2$ such that $m_1 \neq ...
kelalaka's user avatar
  • 48.7k
2 votes
Accepted

Cryptographic hash function based on logistic map?

A brief description of such functions can be found in chapter 9.3 of the paper “Cryptographic Hash Functions: Recent Design Trends and Security Notions” (eprint.iacr.org/2011/565). The following ...
lyrically wicked's user avatar
2 votes

Do hash functions for digital signatures need to be preimage resistant?

A hash function which isn't preimage resistent is also not collision resistance. If I hash a large random message and apply the preimage algorithm I'm extremely unlikely to get the same message I ...
Meir Maor's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible