New answers tagged collision-resistance
1
Most of your questions have been generally dealt with by Hashing passwords with a salt - why use different salt for everyone? and the salt wiki entry.
All I'll do is simply press home that salting is for use with short/low entropy passwords. It stops people pre-computing hashes of common passwords like secret. And here's the rub with your millisecond scheme. ...
2
You're going out of your way to create more work for yourself, and introducing a vulnerability. It's not necessarily a huge vulnerability, but why bother?
To get a number string down to the millisecond - If you can guarantee that you'd not have two requests in the same millisecond.
You cannot have such a guarantee, not without doing very complicated things....
answered Apr 13 at 20:49
Gilles 'SO- stop being evil'
14.1k3 gold badges39 silver badges74 bronze badges
-1
As I understand it, the salt is used to ensure that a hash of two of the same strings results in a different hash.
In short yes.
Remember, the hash functions are not producing unique outputs per input. This can be simply seen by the pigeonhole principle. The input of the hash functions are arbitrary binary strings and the output is fixed length of $b$.
$$H:\...
0
Yes, but please note that the question/answers you are pointing to are about partial collisions on the output, not partial input. Finding a full hash collision is not computationally feasible for hash functions that are considered secure, such as SHA-256.
1
Are problem A and B equivalent? In other words, do both take $2^{256}$ work?
No; in the first case, you can find the first collision with $2^{128}$ effort and then find the second collision with $2^{128}$ effort, yielding a total effort of $2^{128}+2^{128} = 2^{129}$
Actually, you'd likely start hashing arbitrary values, and stop after both a second ...
2
is $\Pi$ chosen plain-text secure (CPA)?
Not necessarily; you could easily design a collision resistant hash function for which this construction is not CPA secure.
For a trivial example, let $H'$ be an arbitrary collision resistant hash function as set $H(x)= 0 | H'(x)$; $H$ is obviously just as collision resistant as $H'$, but in this construction there ...
2
I hope that I am misunderstanding your question otherwise it looks horribly unsafe and deterministic. See, Play a CPA game.
Round 1:
choose two messages $m_0$ and $m_1$ and send it to oracle, and you get either $H(k)⨁ m_1$ or $H(k)⨁ m_2$. You now have two candidates for $H(k)$.
Round 2 repeat the same with different messages and you know $H(k)$,
A hash ...
3
It depends what you mean by collision resistance.
If by collision resistance you mean that the output of $H(.)$ cannot be distinguished from a stream with full collision entropy (i.e. a $H_2=\ell$) then by Jensen's inequality we cannot distinguish from a stream with Shannon entropy at least this large and so the conditions for a one-time pad are met.
If by ...
1
The other answers have already pointed out that a secure hash function almost certainly has input-output pairs of this kind. What the answers so far have not pointed out is that it is trivial to construct a hash function that fulfills all standard hash function security criteria and for which a fixed point is known.
For instance, set $H(x) = SHA256(x) \oplus ...
Top 50 recent answers are included
