267 votes

Why can't we reverse hashes?

Take a simple mathematical operation like addition. Addition takes 2 inputs and produces 1 output (the sum of the two inputs). If you know the 2 inputs, the output is easy to calculate - and there's ...
adelphus's user avatar
  • 2,274
133 votes

How do hashes really ensure uniqueness?

The simple answer is that hashes don't ensure uniqueness. Very broadly, hashes behave like "deterministic random numbers" – deterministic in the sense that hashing the same data always ...
David Richerby's user avatar
69 votes

Are there two known strings which have the same MD5 hash value?

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. ...
Silverfox's user avatar
  • 861
61 votes
Accepted

How can hashes be unique if they are limited in number?

how can for example SHA-256 be unique if there is only a limited number of them?! Where your issue occurs is that they're not unique. It's just very improbable that they'll reoccur. Unique in ...
Paul Uszak's user avatar
  • 15.3k
56 votes
Accepted

How secure is SHA1? What are the chances of a real exploit?

Actually SHA-1 has been "officially insecure" for a longer time, since an attack method was published in 2011. The 2017 collisions was just the first known case of actually running the attack. But ...
Thomas Pornin's user avatar
52 votes
Accepted

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Yes, SHA1-signed certificates are unsafe. The SHAttered paper is instructive. From the introduction: The MD-SHA family of hash functions is the most well-known hash function family, which ...
Squeamish Ossifrage's user avatar
42 votes

Why can't we reverse hashes?

Cryptographically secure hashes were specifically build to (among other things) make what you're asking hard! Now, you could try to create an appropriate dictionary of all hashes, hoping to find ...
e-sushi's user avatar
  • 17.9k
38 votes
Accepted

If a hash function $H$ is collision resistant, is it true that $H(x)\neq H(x')$ for all messages $x, x'$ with $x \neq x'$?

As you correctly observed, for any function $H\colon \{0,1\}^\ast\to\{0,1\}^n$ collisions must exist, simply because $\{0,1\}^\ast$ is an infinite set and $\{0,1\}^n$ is finite. One could define "hash ...
yyyyyyy's user avatar
  • 12.1k
36 votes
Accepted

What are the odds of collisions for a hash function with 256-bit output?

Birthday problem for cryptographic hashing, 101. Let $p_n$ be the probability of collision for a number $n$ of random distinct inputs hashed to $k$ possible values (that is, probability that at least ...
fgrieu's user avatar
  • 140k
34 votes

Fixed point of the SHA-256 compression function

SHA-256 is based on a Davies–Meyer compression function. Easy to find fixed-points are a known property of this construction. A notable property of the Davies–Meyer construction is that even if the ...
CodesInChaos's user avatar
  • 24.8k
34 votes
Accepted

After Google's collision attack, is RSA-SHA1 signature still safe?

The answer is "not safe". But it is not safe, regardless of Google's attack. Before Google attacked, we knew that SHA-1 is not the best choice. Google found one collision based on some existing, ...
Weikeng Chen's user avatar
34 votes
Accepted

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

Define $H(x) = \operatorname{SHA-256}(x) \mathbin\| 1$; that is, append a single 1 bit to SHA-256. Can you find a collision under $H$? Does $H$ have anything resembling uniform distribution? This ...
Squeamish Ossifrage's user avatar
33 votes

How do hashes really ensure uniqueness?

Firstly, some definitions; Pre-image resistant: given a hash value $h$ find a message $m$ such that $h=Hash(m)$. Consider storing the hashes of passwords on the server. Eg. an attacker will try to ...
kelalaka's user avatar
  • 48.3k
32 votes

How can hashes be unique if they are limited in number?

You are right, hashes won't be all unique as you already have shown. The important part are practical collisions - how many SHA-512 hashes can the whole earth generate in its lifetime? Definitely much ...
Nova's user avatar
  • 3,880
32 votes

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which ...
Maarten Bodewes's user avatar
  • 92.4k
30 votes
Accepted

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones. We might ...
Meir Maor's user avatar
  • 11.8k
26 votes

Why can't we reverse hashes?

Strictly speaking, you can, and it stands to reason that you can. A SHA-1 hash has $2^{160}$ possible values. If we just consider $100$ byte binary plaintexts, well, there are $2^{800}$ possible ones ...
slim's user avatar
  • 361
26 votes
Accepted

Mixing algorithms for password hashing good or bad?

Does this look like it's done by someone who knows what they're doing or is it just a case of someone throwing all the algorithms they find together and hoping it's a good solution? This is obviously ...
Gilles 'SO- stop being evil''s user avatar
24 votes
Accepted

What is hardened SHA-1, how does it work and how much protection does it offer?

Hardened SHA-1 detects collisions built of a certain form, If someone were to find a collision using brute-force birthday attack (currently not feasible) the detection would not work. The vectors are ...
Meir Maor's user avatar
  • 11.8k
24 votes
Accepted

What are the consequences of removing a single byte from a sha256 hash?

Does this bias the hash in any way? We want the avalanche criteria on the output bits, that is a change in the any of input bit must randomly affect half of the output bits. Each bit of the hash ...
kelalaka's user avatar
  • 48.3k
23 votes
Accepted

How many hex digits do I need to compare when manually checking hash functions?

How many hex digits do I need to compare when manually checking hash functions? If you actually want the full security guarantees of the hash function to apply: all of them. I usually just look ...
SEJPM's user avatar
  • 45.9k
23 votes
Accepted

What makes SHA-256 secure?

It's worth pointing out that in the case of SHA2 and most other hashes the compression function has a block cipher (keyed permutation) as its core. Basically what you are asking is identical to ...
Jacklos44773's user avatar
22 votes
Accepted

Is using a broken SHA-1 for password hashing secure?

SHA-1 in itself was never safe for password hashing. The hash algorithm itself doesn't have a work factor parameter nor does it have a salt as input. These are requirements for run-of-the-mill ...
Maarten Bodewes's user avatar
  • 92.4k
22 votes

What makes SHA-256 secure?

The design and security of SHA-256 rely on two cryptographic structures; one-way compression function which is based on Davies–Meyer structure which uses SHACAL-2 block cipher and on the top the ...
kelalaka's user avatar
  • 48.3k
21 votes

Why can't we reverse hashes?

I'm taking a guess at where your confusion stems from. The one-way-ness of hash functions does not relate to the mathematical property of being a not injective function. A function $f$ that is ...
Elias's user avatar
  • 4,903
21 votes
Accepted

Are there any well-known examples of SHA-256 collisions?

No, there is not any known SHA-256 collision. Publication of one, or of a remotely feasible method to obtain one, would be considered major. It is next to impossible that two distinct strings with ...
fgrieu's user avatar
  • 140k
20 votes
Accepted

How hard is it to generate a simultaneous MD5 and SHA1 collision?

Surprisingly enough, it would appear that generating a simultaneous collision wouldn't be that much more expensive than generating a single collision for SHA-1. The basic idea is to form a $2^{64}$ ...
poncho's user avatar
  • 146k
19 votes
Accepted

What is the probability to produce a collision under two different hash functions?

A "simple" answer (but somewhat wrong) would be the following: define function $H$ which is the concatenation of MD5 and SHA-1; i.e. on input $x$, $H(x)$ will be the 288-bit string consisting of MD5($...
Thomas Pornin's user avatar
19 votes

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

The only differences in calculations are the initial value and the output size. From NIST FIPS 180-4 The initial hash value, $H^{(0)}$, shall be set as specified in Sec. 5.3.4; and The 384-bit ...
kelalaka's user avatar
  • 48.3k

Only top scored, non community-wiki answers of a minimum length are eligible