Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

# Tag Info

18

The only differences in calculations are the initial value and the output size. From NIST FIPS 180-4 The initial hash value, $H^{(0)}$, shall be set as specified in Sec. 5.3.4; and The 384-bit message digest is obtained by truncating the final hash value $H ^{(N)}$, to its left-most 384 bits: H_0^{(N)} \mathbin\|H_1^{(N)} \mathbin\|H_2^{(N)} \... 10 I'm answering the following which was asked in the original question: Why is stock chacha20 not good as a cryptographic hash? Why create BLAKE? Why not simply apply the one-way compression function concept on raw chacha20, specifically its quarterround() function, unaltered. TL;DR: Chacha was meant as a stream cipher, it needs a different kind of ... 7 OK, so the core ChaCha primitive (for any fixed number of rounds) is a function \operatorname{ChaCha}: \{0,1\}^{256}\times \{0,1\}^{64}\times\{0,1\}^{64}\to \{0,1\}^{512} which is believed to be a secure PRF when the first input is the key. So now that we know what ChaCha is, for the desired functionality of hashing: At a fundamental level it's unclear ... 7 If this provided any insight, we would consider SHA-256 to be broken. In general, we expect the n-bit truncation of SHA-256 to resemble an n-bit uniform random function. For example, finding a 10-bit partial preimage costs an expected {\approx}2^{10} trials; finding a 10-bit partial collision costs an expected {\approx}2^5 trials. That said, there ... 6 No, the length extension attack/property is not considered a collision. It does not allow to build a collision. The length extension property is that given the hash of a bitstring M of given length l (but arbitrary and unknown content), it is possible to compute the hash of M\mathbin\|F(l)\mathbin\|E with F(l) a short bitstring deduced from the ... 5 OK, so the core ChaCha primitive (for any fixed number of rounds) is a function \operatorname{ChaCha}: \{0,1\}^{256}\times \{0,1\}^{64}\times\{0,1\}^{64}\to \{0,1\}^{512} which is believed to be a secure PRF when the first input is the key. So now that we know what ChaCha is, for the three desired functionalities: MAC. Of course a PRF is also immediately ... 5 Why is stock chacha20 not good as a cryptographic hash? You haven't specified what kind of ‘cryptographic hash’ you mean, but since you're comparing it to BLAKE, it sounds like you're looking for collision resistance, which was the central motivation for the whole SHA-3 competition in the first place after MD5 and SHA-1 fell to collision attacks in 2004/... 5 Short answer: You could do this, but (a) it would be dramatically more expensive, (b) it would not improve security in the way you think it would, and (c) it would by design have back doors. Every now and then, we read that some hashing function has been weakened or broken, but we almost never hear this for asymmetric cryptosystems like RSA or ECC. That's ... 4 A protocol might rely on using some string x as an index into a set of uniform random bit strings H(x). The security of the protocol may rely on the H(x) being uniform random and independent for different x. A complex protocol may rely on having multiple independent uniform random bit strings for any particular string x, used for different ... 4 The hash of a zero-length message is defined for several reasons: There's no reason not to define it. If (as you assume) it'll never be used, then it doesn't matter whether it's defined and there's no reason to avoid defining it. Having it undefined would create a weird exceptional case that'd need to be handled by anything that uses the hash, just in case ... 4 From the way I understand your question, your encryption scheme works as follows: For a message consisting of \ell blocks m=m_1\|\dots\| m_\ell and a key k the ciphertext c=c_1\|\dots\| c_\ell is computed as c_1:=m_1\oplus H(k) and c_i:=m_i\oplus H(c_{i-1},m_{i-1}) for 2\le i \le \ell. This scheme has several problems. First of all it's ... 3 Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305? Performance. Poly1305 is extremely cheap to compute, and the computation can be essentially arbitrarily parallelized, because it's just evaluating a polynomial modulo 2^{130} - 5. In contrast, functions like BLAKE2 and Rumba20 can't be parallelized ... 3 I didn't follow all of the question, but let's take a small example. Suppose X is uniformly distributed in \{1,2,3\}, so that \Pr[X = x] = 1/3 for any x \in \{1,2,3\}. If we define \begin{equation*} f(1) = 2, \qquad f(2) = 3, \qquad f(3) = 2, \end{equation*} then we have \begin{align*} \Pr[f(X) = 1] &= 0, \\ \Pr[f(X) = 2] &= \... 3 What do you mean by "differing only in their salting"? A correct implementation of bcrypt should generate a unique salt for each hashed password. The salt is stored along with the hash itself, so yes, the migration is as simple as just using the old values in the new system. 2 The hash output length does not need to be larger than 512 bits; the ECDSA specification can handle any length. The curve secp521r1 is usually considered to provide 256 bits of security (even though it provides a bit more), see Table 2 of NIST SP 800-57 for example. Therefore, a 512-bit hash, i.e. SHA-512, should be fine ("The security strength of the hash ... 2 What you've done is to shift the 64 bits that you require to the left, before printing out the values. So instead of looking at the bits directly, you are looking at a shifted representation of them. However, if you do that you multiply with a power of two, not a power of ten. To be precise, if you shift 64 bits to the left then you multiply with2^{64} = ...

2

A universal one-way hash function (or UOWHF), also known as a target-collision-resistant (or TCR) hash function, is a randomized hash function $H_r(m)$ with the following security: If an adversary commits to a message $m$, then upon being challenged with a random $r$, the adversary cannot find a distinct message $m' \ne m$ such that $H_r(m) = H_r(m')$. (...

2

Why does SHA-512 take less time? Not for cryptographically relevant reasons. Only examination of the code (source, perhaps object) could tell. Essentially, SHA-384 is SHA-512 with a different starting constant, then removing 128 bits of the result. One possibility is that this removal is in separate code using the code for SHA-512 as a subprogram. It could ...

1

The number of NVIDIA TESLA V100 in the Summit supercomputer is documented, and it's reasonable to assume that most of its hashcat performance for SHA-1 would come from that: according to this source on the Power9 CPU ISA, there is no SHA-1 instructions for the Power CPUs, and then these benchmarks give an order of magnitude on other CPUs. Isn't that enough ...

1

Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. You seem to be using the standard technical term ‘uniform distribution’ in a confusing way. Normally the uniform distribution on a finite set $A$ means the probability distribution $P$ with $P(x) = 1/\#A$ for all $x \in A$, ...

1

Well, not exactly. The hash function that your MD internally uses a compression function $f:\{0,1\}^{256} \to \{0,1\}^{128}$ MD construction uses an IV, in your case 128-bit feed into the first call $f$. The first input and output of $f$ is $h_1 = f(IV\mathbin\|m_1)$. From these, you can deduce that you must divide your message $m$ into 128-bit blocks. ...

1

It's simply due to a hash function acting (within it's block size $n$) as:- You'll notice that there is no possible 'A' output as there was a collision at 'C'. It's a version of the pigeon hole principle meaning that when two birds occupy one hole, you must have an empty hole remaining. Some of the output bins of a pseudo random function (hash extractor) ...

1

What you are looking for is a permutation, and not normally what we call a hash function. The identity function is a permutation and so is modular addition. And many more. You probably want some other properties of cryptographicly secure hash functions such as preimage resistance. A pseudo random permutation will suffice any secure block cipher such as ...

1

It sounds like you have a public store for some data, and you want to use it to store a set of secret elements, with the following operations: Add a new element to the set. Query whether an existing element is in the set. (I'll assume that this is where the story ends—if you're actually trying to do some kind of authentication, there may be substantially ...

1

If you have or just want to have just the email address for authentication then you could store a password hash as value in the public JS file. You could for instance use PBKDF2 with salt and relatively high iteration value. Basically, if you do that, you treat the email address as a passphrase. However, please keep in mind that an email address is really ...

1

This question here gives the probability of such a value, called a "fixed point" existing as 63% (based on assuming a "random" property of SHA256): Cryptographic hash where the hashing function input is similar to the result There is at least one such "fixed point" of the compression function that the SHA256 algorithm uses. An example is here: Fixed point ...

Only top voted, non community-wiki answers of a minimum length are eligible