Hot answers tagged

12

The Insecurity of Proposed Scheme It is not as secure as it seems, in modern cryptography standards it is totally insecure. It is vulnerable to basic Known-Plaintext attacks (KPA) and in Modern Cryptography, we want a cipher secure against at least Chosen Plaintext Attack (CPA) or better Ind-CPA. Now take the idea $$K' = H(X\mathbin\|K) \mathbin\| H(H(X\...


7

The obvious weakness when one sees a square is $$(a)^{2} = (-a)^{2},$$ This is not a problem in the Rabin Cryptosystem since it requires an additional mechanism to resolve the message from possible 4 candidates. Here, however, this is can cause a direct collision. Also, as noted by fgrieu, the calculation of the square root is not hard in the prime case by ...


6

Using the hash function; $$h(M) = \operatorname{AES-Enc}\big(M[0\ldots n], M[(n+1)\ldots 2n]\big) \oplus M[0\ldots n]$$ One can find many pre-images with the given hash value $h$ take arbitrary $M[0\ldots n]$ calculate $x = M[0\ldots n] \oplus h$ Decrypt AES with the key $M[0\ldots n]$ and the ciphertext is $x$ $$m =\operatorname{AES-Dec}\big(M[0\ldots n],x\...


5

One can construct such an example artificially. Denote the key to the hash function by $s$ (and recall that this key is public). Now, let $H$ be any universal one-way hash function, and define $H'_s(s) = H'_s(s+1)$. This requires changing just one point in $H$, and so is easy. Notice that $H'$ is clearly not collision resistant: given $s$, just output the ...


3

The other answers did not mention the Length-Extension attacks on the Merkle–Damgård construction. Length extension is given a hash value $h$; $$h = \operatorname{SHA-256}(\text{IV},\text{secret_key}\mathbin\|\text{known_data}\mathbin\|pad1)$$ the attackers can produce an extension as; $$\operatorname{SHA-256}(\text{IV},\text{secret_key}\mathbin\|\text{...


3

Dan Boneh's explanation is about finding a collision for the compression function $h$ defined by $h:\ (H,m)\mapsto h(H,m)\underset{\text{def}}=E(m,H)$ where $E$ is a block cipher with first parameter as key. Notice that the input of function $h$ is neither $H$ nor $m$; it's the pair $(H,m)$, or equivalently the bitstring $H\mathbin\|m$. Finding a collision ...


2

Section 2.6 of their submission talks about this. There they state that for most cases they simply use SHA-256, -384 or -512. In the (uncommon?) case that a hash function with a larger output is needed, they use the OFB-like1 construction. The rationale being that a collision on the OFB construction would immediately imply a collision on the underlying hash ...


2

The question as initially asked essentially considers a 64-bit symmetric Feistel cipher with 16 rounds, a large (128-bit) key, a near-ideal round function, but the same function and key at each round. A slide attack allows at least a distinguisher, I think with in the order of $2^{31}$ queries to an encryption oracle. With some more, it might be possible to ...


2

Even collision resistance is not sufficient to make HMAC unforgeable, so neither is second-preimage resistance. Let $H : \{0,1\}^* \to \{0,1\}^n$ be a collision resistant hash function. We define the hash function $H' : \{0,1\}^* \to \{0,1\}^{n+1}$ as $$H'(m\Vert b) = H(m)\Vert b,$$ where $|b|=1$. Since for any $m_0\Vert b_0$ and $m_1\Vert b_1$, it holds ...


1

In cryptography, we often assimilate bitstrings to integers. Unless otherwise specified, that is per big-endian binary, where a bitstring $S$ of $n$ bits $b_0,b_1,\ldots b_{n-2},b_{n-1}$ is assimilated to integer $s$ with $$s=\sum_{i=0}^{n-1}b_i\,2^{n-1-i}$$ E.g. bitstring 00010001 (which is 8-bit) is assimilated to integer $16+1=17$. Bitstring ...


1

(1) Yes, it would be a concern. Once upon a time, Dropbox did this. When synchronizing the files, it checked the hashes before uploading. Thus, if the file was already in their servers, they just linked it and the transfer was instantaneous. Then people started using it for sharing content. By having the hash of e.g. a movie, they could "claim" to ...


1

It's indeed a genuine concern. How to fight this? Well, once client had provided the SHA256 hash of the file (to quickly index the file on the server), your server then provide a random one-time key and ask the client to hash the file again with HMAC and the key. Since the key is one-time and random, adversaries have little chance at guessing the key and ...


1

First of all, there is no problem with using SHA256 or SHAKE128/256[1] those would have had $2^{128}$ collision resistance with a 50% probability by the birthday attack. If you really fear that switch to 512-bit versions. Take SHA512 or Shake256/512 both have $2^{256}$ collision resistance with a 50% probability by the birthday attack. Even if you ever hash $...


Only top voted, non community-wiki answers of a minimum length are eligible