Hot answers tagged

5

XChaCha20 requires a 192-bit nonce size. As a rule of Stream ciphers, the nonce should not be repeated under the same key. Note that; Daniel J. Bernstein is pointed in the XSalsa20 article for Salsa20 which has 64-bit nonces. There is a standard argument that a 64-bit nonce is long enough. Nonce security does not mean unpredictability; it means ...


4

Would it be easier to find collisions, preimages, etc? First note that if you can find preimages for a compressing function (like a hash) you can also find collisions. This means if we can't find collisions, then we also can't find preimages and thelike. Now, the scenario you are describing is called a "freestart collision attack". Freestart collisions are ...


4

I'd expect a 196-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 196-bit nonce [...] Actually, we don't need to appeal to the truncated SHA-256 being random; we can get away with appealing to collision resistance. Even if we allow an ...


4

NIST FIPS 180-4 on page 13 defines the padding scheme for SHA-512 as; Suppose that the length of the message, $M$, is $\ell$ bits. Append the bit 1 to the end of the message, followed by $k$ zero bits, where $k$ is the smallest, non-negative solution to the equation $$\ell + 1 + k \equiv 896 \bmod 1024$$ So you first append 1, then calculate the ...


4

Is there a way, then, of doing something like the above, but without the need for a central authority? Why, yes, we do have a way to solve that problem - we refer to it as a 'digital signature' Here's how it works: Select a signature algorithm, and come up with a public/private key pair for a signature algorithm With the private key, generate a signature ...


4

It is not possible: Let $d_A, d_B$ be distinct private keys. Then $$ s=k^{-1}(z+rd_A)=k^{-1}((z+r\;(d_A-d_B)) + rd_B) $$ So the pair $(r, s)$ is not only a valid signature for the public key $d_AG$ and the (partial) hash $z$, but also for the public key $d_BG$ and the message hash $z+r\,(d_A-d_B) \pmod n$. So in many cases (if there are no restrictions ...


3

Short answer; Almost NO! Can I have it by keep hashing the second one? There were great answers for the question; Cycles in SHA256 In short, if we model SHA256 as a uniform random function then the probability of element being on the cycle is $$\frac{1}{\sqrt{\hspace{.03 in}2\hspace{-0.05 in}\cdot \hspace{-0.04 in}\pi} \cdot 2^{127}}$$ The average ...


3

Since antiquity (and, for ceremonial purposes, up to the present day) physical document have had seals affixed to them. In principle, these seals allow anyone, if he knows what he's looking for, to judge the authenticity of a document without consulting the authority that issued it. (In practice, there are obviously ways of producing convincing forgeries, ...


3

It is in the part of the internal block cipher of SHA2 that has 64 or 80 rounds depending on the mode, SHA256 has 64, SHA512 has 80 rounds. Why do we need T1 and T2 in this case? Except the $T_1$ and $T_2$, everything is linear. In the picture, they are the blue and red word additions ($\color{red}{\boxplus}$). Being only linear is not a good idea in ...


3

Generally you don't want to switch algorithms in cryptography. You'd have to deal with different workloads. Furthermore, the choice of algorithm would be just another salt, if a tiny one. However, your approach doesn't disallow the building of 5 separate rainbow tables. So the reason for a salt isn't met. It is unclear why you would not be able to use a ...


2

Generic expected pre-image resistance for a hash function with $n$-bit output is $\mathcal{O}(2^n)$ Generic expected collision resistance for a hash function with $n$-bit output is $\mathcal{O}(\sqrt{2^n}) = \mathcal{O}(2^{n/2})$ due to the generic birthday attack on the hash functions. \begin{array}{|c|c|c|c|}\hline \text{name} & \text{output size} &...


2

Here's your development brief First, you pad until you have 16 bytes left, using 0x80 for the first byte, bytes valued 0x00 after that. If you run out of space (you need 17 bytes minimum) then you pad until you reach the end of the block, and continue padding with 0x00 in the next block until you have 16 bytes left for the length. In most implementations ...


2

ChaCha20 is a stream cipher, therefore, knowledge can be used. Let see what one can do. When it comes to key rotation, you'll need to store those encrypted values twice, for a short period of time (under the old and new keys). This means that the attacker has a chance to see these $C_1 = P\oplus K_1$ and $C_2 = P\oplus K_2$. X-oring these two ciphertexts;...


2

By using more iterations you increase the work factor that an attacker needs to deal with needed to conduct a brute force attack. This is a good thing. More is generally better as long as it doesn't affect user satisfaction with UI responsiveness. I think 10,000 iterations would be considered a low number at this point. 50,000 or 100,000 would be ...


2

Your solution is not resistant to a rainbow table attack. Furthermore, what if an adversary supposes your locality: ask you about your "private" location information, fake his/her one and tries to retrieve yours? When you say "Anonymous location" and "without revealing the location" you are demanding a very difficult problem of Multiparty Computation: see ...


2

Questions of such kind have opinion based answers. Here is my opinion. First review your requirements and check what do you actually want to achieve, what are the costs if you want to use key derivation (how much hardware you need for particular hashing), what are the risks if you don't use hashing. You say you want to use card number as fingerprints. A ...


1

You are expecting that the hash that is produced is always over the complete file. This is not correct. Authenticode uses the Cryptographic Message Syntax - a container format - to embed the content and the signature. This ensures that the Authenticode signature is using the hash of the original data (+ other signed attributes). The Authenticode format is ...


1

No, actually your 32-bytes would only be a representation of the 8-bytes random (or pseudorandom) number. In this case if I want to attack you system (eg. by brute force) I need only to perform 2^8 attempts instead of 2^32 as someone could expect. This occurs because the 32 hash is only a deterministic representation of a very small 2^8 number.


1

The NSA created SHA (quickly replaced by SHA-1 to fix a security issue that remained unpublished for years) because they/the US government needed a 160-bit hash function, so that it has 80-bit security against collision-resistance, in particular towards use in the DSA signature system of FIPS 140. In this usage, a hash functions condenses a possibly ...


1

First note that the following holds: $$h(a)=K\cdot a+K'\cdot \bar a=K\cdot a+K'\cdot(a+1^n)=\underbrace{(K+K')}_M\cdot a+\underbrace{K'\cdot 1^n}_c=M\cdot a+c$$ Also note that $h(a)=M\cdot a$ is an universal hash function for $n$-bit input and $m$-bit output, as $\Pr\left[h(x)=h(y)\right]=2^{-m}$ with the randomness being over the choice of $M$. Clearly in ...


1

No, the proposed commitment scheme is not perfectly hiding. Depending on what you require from the hash function, it may not be hiding at all. If you only require collision resistance (which would be the standard security property of a hash function) you cannot prove the construction even computationally hiding. This is because a collision resistant hash ...


1

I'm unaware of any proof of impossibility (although it wouldn't surprise me if one existed), but the fundamental issue here is there's no fundamental way that "physical identity" and "digital identity" are bound together. In short, given any algorithm $\mathcal{A}$ which generates some "seal" (or some private information used to generate seals in the future),...


Only top voted, non community-wiki answers of a minimum length are eligible