New answers tagged collision-resistance
0
1) Just assume $H_1(x)$ is weak and you can generate two $x_1,x_2$ with the same hash. The other hashes then work on the same input, and hashes are deterministic, so the final output is the same. So on the first glance, it seems at best the collisions resistance is equal to the minimum of the functions. But it could also be worse. On the other hand, it ...
2
There are no known attacks on SHA3 series that are faster than the generic attacks.
Your problem is the 2nd pre-image attack: given a message $m_1$ finding another message $m_2$ such that $m_1 \neq m_2$ and $Hash(m_1)=Hash(m_2)$.
SHA3-256 has $2^{256}$ 2nd preimage resistance.
Now, you only allow the attacker first 20-byte which is 160-bit of your data. ...
2
I think what you're asking is:
We know there certainly exist two 33-byte strings $m \ne m'$ such that $H(m) = H(m')$, when $H$ is (say) SHAKE128-256, because there are only $2^{256}$ distinct possible outputs of $H$ and $2^{262}$ distinct possible 33-byte messages.
Do there exist two <32-byte strings, say 16-byte strings, $m \ne m'$ such that $H(m)...
1
Think of an abstract hash function as a black-box mapping from an arbitrary input to a finite output.
Since the number of possible inputs is infinite, if you assume the function to approximate a stable (because it's a hash), random (cryptographic) mapping of input to output, each output value must have an infinite number of collisions (infinite input space /...
1
Defining a hash function formally is not an easy task. There are even entire papers covering that formalization, especially if there is a requirement that the function should be unkeyed (see for the keyed variant below).
The most popular variant to formalize hash functions are the use of choosing a hash function chosen from a family of hash functions ...
2
Let the range $Y$ of the function $f$ have size $N$ A collision resistant function cannot be better than an ideal function which maps uniformly into $Y$ since collision probability is minimized by the uniform distribution. Thus, given $(x_0,f(x_0))$ the number $k$ of random points $x_i\neq x_0$ that must be tried before the probability that $f(x_i)=f(x_0)$ ...
3
Lets get one thing out of the way: forcing one bit to 0 or 1 does not change the output size of the hash. A hash output is not a number, so the output size would not be affected.
Reducing hash output is common practice. Although maybe not a direct requirement, generally the output of a hash is considered indistinguishable from random - if the input is ...
18
With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit hash, you get a $k$-bit hash function. Truncating SHA-256 to 255 bits gives you a hash that's almost as good as SHA-256: it has $2^{255}$ strength against ...
6
Apart from the slightly reduced resistances, there is no problem:
Resistances for SHA3-512;
Pre-image resistance decreased to $2^{511}$ or $2^{504}$, if 1 bit or 1 byte trimmed, respectively.
Secondary preimage resistance decreased to o $2^{511}$ or $2^{504}$, if 1 bit or 1 byte trimmed, respectively.
Collision resistance decreased to o $\sqrt{2^{511}} = \...
Top 50 recent answers are included
