Hot answers tagged

4

Is any existing hash algorithm strong enough? Yes; actually, any cryptographically secure hash algorithm (such as SHA-2, SHA-3, Blake2) would be plenty strong enough. To emphasize this, let me point out that MD5 is strong enough. Now, MD5 is considered quite weak (and no one here would endorse its use); however even with its known weaknesses, it is still ...


4

This is simply a hash commitment by the Casino and this is not a pre-image problem. Before all of the games start, the casino chooses a $seed$ and hash it $2M$ times. let $H^{s}(m)$ represents hashing $m$ $s$-time in cascading $$H^{s}(m) = \underbrace{H(H(\ldots (H(m) ))}_{s-times}$$ The 1st game starts with $H^{2000000}(seed)$ When the 2nd game starts with $...


3

Your scheme works, but there is no need to have $r_p$. If you remove $r_p$, then it's important to agree in advance what the bit length of your blinding factor $r_s$ will be, so that the commitment is not malleable by deciding to remove or add bits to the start of $T$ while adding or removing bits to what you later claim to be the value of your blinding ...


3

You cannot get public key from fingerprint. The purpose of sharing fingerprints is to make sure that particular public key really belongs to particular person. When you want to encrypt a message to some person, you ask this person for a public key and receive it per Email. For some persons, e.g. for some developers, you can find their public key on different ...


3

It might be a huge problem in your case since there is an identical prefix collision in MD5; |identical prefix | free part of file A | identical suffix | |identical prefix | free part of file B | identical suffix | ^ they have collision here| the rest is the same Although Today the collision ...


3

Hash functions are candidates for random oracles. SHA-3 and BLAKE2 are close to being one but not SHA-512 since it has a length extension attack that we don't expect from a RO. The different hash functions already produce different outputs even SHA-512 and its truncated version SHA-512/256 since their initial values are different. Actually, you don't need ...


3

Generally no. In cryptography, the appearance of "random" strings of numbers is generally quite suspect --- what if there are certain "weak" choices of numbers that yield the entire construction insecure? How do you know the designer didn't use their freedom in choosing these numbers to embed a backdoor? Note that this does happen, famous ...


2

In order: unspecified, it may be any block cipher (with the desired output block and key size); unspecified, it may be any constant of the right block size; unspecified, it may be any padding type that suites the key size. Davies-Meyer is a construction for a compression function, not an actual algorithm that can be used out of the box. Usually these ...


2

Since you need only validation you can simply use a fast hash function like BLAKE2 for your aim. $$ c_0 = E_{k_1}(m_0) $$ then append the 64-bit (or more) BLAKE2 hash of ciphertext $$m_1 = c_0\mathbin\|BLAKE2(c_0)\mid_{64}$$ $$ c_1 = E_{k_2}(m_1) $$ then then append the 64-bit (or more) BLAKE2 hash of ciphertext $$m_2 = c_1\mathbin\|BLAKE2(c_1)\mid_{64}$$ $$ ...


1

Basic logic would dictate that if any provider can use a non-secret method to generate a hash from a document, then the central service can also use that known method to perform the same hash in order to carry out the dictionary attack. Therefore, to avoid this attack, there must be some secret shared between providers that is unknown to the central service. ...


1

In the random oracle model this is safe to do because you can use a single oracle $\mathcal{O}$ and use domain separation to obtain two independent oracles from it (e.g. $\mathcal{O}(1 \parallel \cdot)$ and $\mathcal{O}(2 \parallel \cdot)$, where $\parallel$ denotes concatenation). Then you can consider the outputs to be totally independent from each other. ...


1

Let assume that someone built a Cryptographic Quantum Computer (CQC) that specially can run Grover's algorithm. Grover's algorithm is asymptotically optimal that is one needs $\mathcal{O}(\sqrt{n})$-time for the $n$ bit security for pre-image attack or key search. That is one have 128-bit security from from 256-bit key space. This is the advertisement of the ...


1

The answer is not easy, however, a good starting point is Florent Chabaud and Antoine Joux's paper on SHA-0 and SHA-1 Differential Collisions in SHA-0, Crypto 1998. Simple Introduction In, MD4, SHA-0,SHA-1, and SHA-2 there is a compression function. $$C:\{0,1\}^\ell \to :\{0,1\}^n$$ where $n$ is the output size and $\ell$ is the block lenght to process. ...


1

On should note that a simple concatenation with only $r_s$ will not work; The committer can fool the verifier. This is due to the simple concatenation. For example $H(\texttt{100110||11})$ is the commitment with the temperature prediction is $3^\circ$ ( $\texttt{11}$ in binary). If the temperature turns out $11^\circ$ then the committer can claim that that ...


1

Terminology is important here. A cryptographic salt's main purpose is to secure passwords during reuse and avoid hash pre-computation. So yes, that provides your domain separation. But your question is about randomness extraction from arbitrary sources i.e including devices. NIST's SP800 90B "Recommendation for the Entropy Sources Used for Random Bit ...


1

SHA-256 is resistant to preimage attacks. The only way to find a preimage that produces given hash is brute-forcing. Current computation resources used for bitcoin mining in the world compute about $2^{90}$ hashes per year. Thus, even if the whole world tries to create an image (in your case, to find particular padding) with the given hash, it will not be ...


1

First look at $\operatorname{SHA3}(S)$ $\operatorname{SHA3}$ is a cryptographic hash function built for pre-image, secondary pre-image, and collision resistance. If you use $\operatorname{SHA3}-512$ then you will get 512-bit first and second pre-image resistance and 256-bit collision resistance. In your case, the pre-image resistance is important and the ...


1

When people hand out their public key fingerprints, it's almost always a PGP key. Usually, you can get the original PK from the fingerprint by looking the fingerprint up on a public PGP key server. For example, if someone tells you their PGP key fingerprint is 5744 6EFD E098 E5C9 34B6 9C7D C208 ADDE 26C2 B797 you can look it up on a PGP key server like so ...


1

No, it cannot. A nonce is necessary to have any security at all if a key is ever reused. The "nothing up my sleeve" number is necessary to keep the input from all being attacker controlled, it prevents the all-zero block, and its asymmetry improves the confusion and diffusion of the function.


Only top voted, non community-wiki answers of a minimum length are eligible