Tag Info

20

First of all, the output of SHA-256 is binary and consists of 32 bytes (256 denotes the output size in bits). What you are talking about is apparently the hexadecimal encoding of these bytes. The possibility that you are talking about is called (1st) pre-image resistance (Wikipedia): Given a hash value $h$, it should be difficult to find any message $m$ ...

15

Yes, it's possible. Given the size of the input space (not actually infinite, but still very, very large), it's also likely, for any given 256-bit value, that several inputs that hash to that value exist. No, there's nothing special in the construction of the algorithm that prevents it (restricting the output space would probably be bad for security). ...

7

Adding information to the answer of poncho. The predominant factor that slows down the hashing operation for SHA512 is the amount of clock cycles required to perform a compression function. For SHAKE256, this is the Keccak permutation. For SHA512, the input string is preprocessed before actually performing the compression functions. First, a "$1$" ...

6

No. Any adversary could simply perform the hash themselves and so you are providing them with no additional resources.

5

But would that also be possible practically, or do the algorithms check that this is not happening? This is practically beyond anybody to find a 32-$a$'s for SHA-256 without pure luck or one need breaking the pre-image resistance of SHA-256, that is not possible. Is it possible that a SHA256 hash has the same character 64 times? Yes, and No. We don't know ...

5

First, we need to model SHA-512 as uniform random. Start hashing random values. In hex we have 4-bits We would expect about 1 in $2^4$ values to have a hash-value with 0x0 at the beginning. We would expect about 1 in $2^8$ values to have a hash-value with 0x00 at the beginning. We would expect about 1 in $2^{12}$ values to have a hash-value with 0x000 at ...

5

We don't approach our security through obscurity, we live in a world that Kerckhoffs's Principles rules! We assume that everything is known by the attackers except the key/password is secret. Your modification only hardens the search a little; just one more hash! Password hashing has gone a longs way and in modern password hashing, we want them memory-hard ...

4

For the usual suspects (MD family, SHA family etc.) none are known to be weakly uniform (to be picky, they also aren't known to be cryptographically secure). To demonstrate uniformity in a constructive way would give a collision attack; to do it in a non-constructive way would be an existence proof that would generally use some sort of mathematical structure ...

3

You're looking at just one small part of the protocol. TLS, like any other communication protocol combines several cryptographic primitives to provide communications security. The algorithms used to secure the communication channel are described by a cipher suite, which combines a key exchange method (usually some form of Diffie-Hellman), an authentication ...

3

Let $H$ be a collision resistant hash function. This implies that it is also second preimage resistant. Let $x_0,x_1$ be two arbitrary values from the domain of the hash function. We define the new hash function $$H'(x):=\begin{cases}H(x)& \text{if }x\neq x_0\\H(x_1)&\text{if }x=x_0\end{cases}.$$ This hash function is trivially not collision ...

3

Take the output $H$ of $\operatorname{SHA-256(M)}$ or any other hash of $b$ bits. Count the number $u$ of bits set in $H$ and output $u\bmod3$. This is optimally close to unbiased in $\{0,1,2\}$, for an ideal hash and the requirement to deterministically output a value for any $M$. Counting the number of bits set can be fast. Sometimes there's even an ...

3

We strongly hope that $m_0=0$ as we wish for the SHA512 compression function to perform as a random oracle. Thus for example, if we were to pick a $2^{521}$ long string $s$ there are $2^{521}$ other strings whose Hamming distance from $s$ is 1. The coupon collecting estimate would return all possible outputs with high probability, including the value that ...

3

For several years there was a competition to find the lowest possible sha512sum of some random input. The maximum number of preceding zeros was 12. Beyond the dates between the winners post of an 11 and 12 zero prefixed hash (~4 months) little is known about the actual runtime. If it helps the code is available here.

2

Heading \begin{array}{l|rrrl|rrrl} \text{hash} & d&r&\mu&\text{(bits)}&\tilde d&\tilde r&\tilde \mu&\text{(bytes)}\\ \hline \operatorname{MD5} & 128 & 512 & 65 && 16 & 64 & 9 \\ \operatorname{SHA-1} & 160 & 512 & 65 && 20 & 64 & 9 \\ \operatorname{...

2

Yuval's attack is slightly different from the standard birthday attack where we look for a repeated output in a single family of inputs. Instead we look for a repeated output across two families of inputs with at least one member of each family producing the repeated ouput. The probabilities are slightly different, but in a complexity sense are both $O(\sqrt ... 2 Would hashing a ciphertext (so$H(Enc(pk,m))$) compromise it in any way if both schemes are secure by themselves? This doesn't seem to be the case but I couldn't find a definitive answer. I can read this two ways You only reveal the$H(Enc(pk,m))$to the attackers; then the attackers need to execute pre-image attack on the secure hash function to find$...

2

Would it not be possible to have a collision-resistant 128-bit slow-hashing function to replace MD5? That's possible. We could use Argon2 parameterized for 128-bit output and (say) 10 ms computation on a Raspberry Pi 3. If something could speed this up a hundredfold, and we parallelize on 1 million units, there's <40% chance of finding a collision with $... 2 Bcrypt is a password hashing function likes PBKDf2, Scrypt, and, Argon, where in the password hashing the collision is not important, pre-images are important. If you just iterate the$\operatorname{MD5^n}(x)=\operatorname{MD5}(\operatorname{MD5}(...(\operatorname{MD5}(x)...))$n-times then we will have an already well-known problem. A collision in the inner ... 2 I can only provide a programming sense to this; One may not know the size of the message beforehand (streaming), when finished, the length-padding can be executed nicely at the end. Otherwise, the system must store all of the messages to calculate the size, this will be very bad for constrained environments. 2 I'm not sure about what you mean for "more safe". A probable link between these notions exists when we consider a context/application: suppose we need a secure identification scheme; the adversary is listening to the channel between the identifier and the identity-server. By considering this context, we can say that an identification scheme based ... 1 The section you linked to is solely focused on signature algorithms. Either because they cannot do so efficiently, or cannot do so at all, digital signature algorithms do not generally operate on the full message being signed. Instead, most signature schemes use a hash function (e.g. something in the SHA family) to reduce the size of the input to something ... 1 Let consider$h = H(A\mathbin\|B\mathbin\|C)$for SHA-256 or SHA-512 where both are MD-based cryptographic hash functions of NIST with$A$is 1000 bits$B$16 bits, and$C$283 bits and we further assume that the attacker knows$h$and$C$Brute-force search Definitely, the attacker cannot test the 1016-bit of unknown data to match the$h\$. Bitcoin miners, ...

1

In theory, there are infinite inputs, that you can hash with SHA-256. So theoretically it would be possible that one hash string would read 0xaaaaaaaa... But would that also be possible practically, or do the algorithms check that this is not happening? The algorithm has 2256 possible outputs. Let us assume that you don't want the algorithm to output a hash ...

1

But would that be possible practically Is it possible that the SHA-256 of some input would be a repetition of the same hex digit? Yes, most definitely. In theory, any of the values in the output space is possible (though I don't think there's any proof that ALL values are actually possible). Is it possible to find an input, which, once hashed with SHA-256, ...

Only top voted, non community-wiki answers of a minimum length are eligible