# Tag Info

### Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

It does not follow from the definition of a cryptographic hash function that its output would be uniformly random. However, this is the case for the hash functions used in practice. A common ...

### Signing a hash of file vs signing a file

Given person B only has the public key, file, signature and the hash, would verifying the signature using the public key be sufficient to prove person A signed the actual file? Person B does not need ...
• 124k

### Why is the SHA256 in libsnark so slow?

Creating a depth 20 tree will require $2^{20}-2^{21}$ hash function evaluations and this will certainly take on the order of processor-hours of resources. Validating a claimed value for a single node ...
• 10.5k

### Can a hash algorithm get identified by its result with any input?

Identifying hash algorithms by the hash of the empty string works for all correct implementations of common hash algorithms. Every implementation that I ever met correctly handles the empty string. ...
• 124k
Accepted

### Does hashing a secret/seed make it effectively 2X less secure?

Is this bad practice? Not necessarily, but it uses the hash function as a poor-man's key derivation function. For common hash functions this won't introduce any exploitable vulnerability, but using a ...
• 85k

### Why do we need the leftover hash lemma for this hybrid proof (Learning with Errors)?

Your initial question regarding LHL was answered in the comments. I'll just briefly mention that LHL is not required to build PKE from lattices, meaning that there is a (slightly different) ...
• 8,637
1 vote

### Real world hash collision risk, for finite input; uniqueness only no data risk

for my purpose, is there a real risk of hash collision, at any hash (even MD5)? That depends on The number of possible inputs, and width of hash. For $2^s$ inputs chosen independently of the hash, ...
• 124k
1 vote
Accepted

### Proof of computationally binding correct?

The binding should be fine. You cannot change $b$ for the same commitment without changing $<r,s>$. Since $r$ is part of commitment, you can only change $s$ which should be infeasible because $h$...
1 vote
Accepted

### How come we only need to generate the first tree in each layer in XMSS MT

to compute the top layer tree, you need to know the root of each L tree, which involves computing the whole L tree below each leaf. You need to compute the entire top level tree, which involves ...
• 132k
1 vote

### Reset Indifferentiability need and it's implications

Motivation The indifferentiabilityframework is a tool to argue the security of cryptosystems under the assumption that the cryptosystem uses an idealized ideal component. Therefore, ...
• 1,333

Only top scored, non community-wiki answers of a minimum length are eligible