Hot answers tagged

30

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the hash of each with the stored hash. Generally you don't have to deal with all telephone numbers, only a subsection of phone numbers anyway (for a specific country ...


12

It is always a bad idea to hash data that has a limited set of length or characters. A phone number in Germany for example has normally no more than 12 digits. The first digit is always a 0 and the vast majority of numbers is longer as 3 digits, as those are normally reserved for emergency services. This effectively leaves us with 10^11-10^3 possible ...


9

In the general sense, The problem is known as the small input space on the hash functions, and in short simple hashing won't be secure. If you hash data ( here a phone number) and an attacker tries to find an input value that matches the hash value is called the pre-image attack. In a secure Cryptographic hash functions pre-image attack requires $\mathcal{O}(...


8

Yes, you can create many such functions. For instance, lets build such a function based on SHA512. Generate some random value $m_0$ and generate a hash of it. It is important, because there is no guarantee that every 512-bit number has a pre-image. So, let $h_0 = \operatorname{SHA512}(m_0)$. After hash generated, throw $m_0$ away. Technically you can do that ...


7

As an alternative, you can salt the phone numbers to avoid pre-calculation attacks. A known salt will help against an adversary who has already done a hash of all possible phone numbers but just adds one order of magnitude of work (the adversary just has to recalculate all the hashs with the salted phone numbers). If you can keep the salt private raises the ...


7

What needs to be memorized in applied science (physics, crypto) is not a set of formulas. It's, for a few of the simplest formulas studied: what the formula yields, for what inputs, the units for inputs and output, and how to derive the formula when it does not boil down to multiplying or dividing the inputs in a way that can be found from the units. When ...


5

I think you are misinterpreting the security notion of pre-images. That $X$ is considered unknown for a $Y$ doesn't make $X$ a secret in the cryptographic sense. My answer basically evolves around this. From my understanding, if $H(X)=Y$, knowing $Y$, I should not be able to know $X$ is the fundamental behind the first preimage attack. First of all, ...


5

The questions Does the security of a hash function from the preimage attack also depend on the secrecy of the length of X.? The preimage attack: given a hash function $h$ and a hash value $y$ the computationally bounded adversary tries to find a pre-image $x$ such that $y = h(x)$. This is like an adversary trying to find a password given the hash of it ...


4

Would there be any additional benefit to this scheme? Not really; password hashing is storing the hashed password in this form: $$H( \text{password}, \text{salt} )$$ where $H$ is some hard-to-compute hash function. What you are suggesting is to replace this with: $$H( \text{password}, D( \text{password}, \text{encrypted_salt}) )$$ (where $D$ is the ...


4

What happens, when we want to put a message of 575 bit into the algorithm? Obviously we are 1 bit short of the required length, and the padding rule is at least 3 bit long. What happens in that case? In that case, we just extends padding until it hits the next multiple-of-576 boundary; in this case, this means the padding is 577 bits long (and crosses the ...


4

So suppose we define our encryption scheme as follows: $E(K, M) = \operatorname{CTR}(K, M || H(M))$, where $H$ is a hash function (e.g., SHA2-256), and $\text{CTR}$ is the counter mode-of-operation of some underlying blockcipher (e.g., AES-128). Now suppose we observe the ciphertext $C = C_M || C_T $ of a known message $M$ and want to modify some bits in $C$ ...


4

You're wrong. Hint: a value of 8 bits has 256 possible values, not 8.


4

Is there a signature scheme in which $\text{signature} = \mathsf{Sign}(\text{message} \mathbin\| \text{signature})$ ? With standard RSA signatures (RSASSA-PKCS1-v1_5, RSASSA-PSS of PKCS#1), that's possible if one chooses the public/private key pair for that purpose, as a function of the message. On top of that one can even make the signature nearly anything ...


3

If it's replaced by another function with the same length output, then I assume tweetnacl will use its output just as happily? Yes, it seems to be a normal collision-resistant cryptographic hash function, replacing it by any other will not significantly alter the security properties (unless one of them is broken) but will of course break interopability. In ...


3

Case 1: Assuming $\mathbb{F}_2^n.$ The only scalar constants you can have in characteristic $2$ to are $0$ or $1$? So, you need to define multiplication for quantities in $\mathbb{F}_2^n$ for this to be non trivial. Let $n=256.$ For any vectors $b\in \mathbb{F}_2^n,$ your first equation with scalar $a$ is equivalent to $H(x_2)=b$ if $a=0,$ which takes $O(...


2

If $f$ is a cryptographically secure hash function and $X$ is kept secret while $f(X)=Y$ is published, then an attacker can find $X$ if and only if $X$ contains too little entropy. That is, there are too few possibilities what $X$ may be, and the attacker can try them all out and test if $Y$ results. Knowing only the length of $X$ does not help, given that $...


2

While SHA2 (SHA-256, SHA-512) original design goals are limited to collision-resistance and (first and second) preimage resistance, it is not known that its computationally distinguishable from a random oracle for messages of fixed length¹. Thus $\text{SHA2}(\text{seed}+n)$ for incremental $n$ is a CSPRNG as far as we know, for a wide-enough random secret ...


2

An alternative is to encrypt the phone number as proposed in the previous answers. For example, Mobile connect identity service encrypts the MSISDN (aka phone number) using a specific algorithm. This GSMA specification gives information about decoding the payload : Following are the example of encrypted MSISDN passed: with URL encoding: login_hint=...


1

As you mention, phone numbers have low entropy. Someone who "doesn't know" a phone number at the time of the proof can easily obtain the phone number later. You won't be able to find a non-interactive solution to this problem -- an attacker can always run a dictionary attack and use your "proof" as a test for whether they've found the ...


1

However in the case of a private set intersection we can use a secret key $s$, so if I am correct the discrete logarithm of $h(m) *s$ would not be known : That is correct; it is not known; however that is not sufficient; the relationship between $h(m_1) * s$ and $h(m_2) * s$ would be known (if you know $m_1, m_2$), and that breaks security (at least, within ...


1

The combination of different schemes may be somewhat advantageous with regard to certain custom hardware (ASICs), but I think that the disadvantages outweigh them. I assume that there is some kind of fixed time that is acceptable to the user. Nobody will use a procedure where she or he has to wait several minutes. Modern password hashing schemes are ...


1

Note: The attacks you refer to in that thesis are structural attacks, I will consider the complexity of a brute force attack, which would be applicable to any hash function $H$ which is well designed, approximating a pseudorandom function. There are some good answers here on the complexity of the birthday attack on a hash function, which is $O(2^{n/2})$ for ...


1

Is it a good idea [from a security perspective] to use the first 16 bytes of SHA-1 (20 bytes long) as IV? It depends. For CBC, the main requirements is the IV are that it should be unpredictable for the attacker. In particular, you should never ever use the same IV more than once for encrypting messages under the same key. This implies that, in your system, ...


1

What does «CRC32C (alias Castagnoli) is better than CRC32B in detecting errors» exactly means? Multiple metrics are used in the original article. One is: when we restrict to messages of equal length differing by at most some low number of bits (e.g. 4 bit), CRC32C gives certainty of error detection up to a larger message length than CRC32 does. This is ...


Only top voted, non community-wiki answers of a minimum length are eligible