Hot answers tagged

5 votes

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

It does not follow from the definition of a cryptographic hash function that its output would be uniformly random. However, this is the case for the hash functions used in practice. A common ...
user avatar
3 votes

Signing a hash of file vs signing a file

Given person B only has the public key, file, signature and the hash, would verifying the signature using the public key be sufficient to prove person A signed the actual file? Person B does not need ...
user avatar
  • 124k
3 votes

Why is the SHA256 in libsnark so slow?

Creating a depth 20 tree will require $2^{20}-2^{21}$ hash function evaluations and this will certainly take on the order of processor-hours of resources. Validating a claimed value for a single node ...
user avatar
  • 10.5k
2 votes

Can a hash algorithm get identified by its result with any input?

Identifying hash algorithms by the hash of the empty string works for all correct implementations of common hash algorithms. Every implementation that I ever met correctly handles the empty string. ...
user avatar
  • 124k
2 votes
Accepted

Does hashing a secret/seed make it effectively 2X less secure?

Is this bad practice? Not necessarily, but it uses the hash function as a poor-man's key derivation function. For common hash functions this won't introduce any exploitable vulnerability, but using a ...
user avatar
2 votes

Why do we need the leftover hash lemma for this hybrid proof (Learning with Errors)?

Your initial question regarding LHL was answered in the comments. I'll just briefly mention that LHL is not required to build PKE from lattices, meaning that there is a (slightly different) ...
user avatar
  • 8,637
1 vote

Real world hash collision risk, for finite input; uniqueness only no data risk

for my purpose, is there a real risk of hash collision, at any hash (even MD5)? That depends on The number of possible inputs, and width of hash. For $2^s$ inputs chosen independently of the hash, ...
user avatar
  • 124k
1 vote
Accepted

Proof of computationally binding correct?

The binding should be fine. You cannot change $b$ for the same commitment without changing $<r,s>$. Since $r$ is part of commitment, you can only change $s$ which should be infeasible because $h$...
user avatar
1 vote
Accepted

How come we only need to generate the first tree in each layer in XMSS MT

to compute the top layer tree, you need to know the root of each L tree, which involves computing the whole L tree below each leaf. You need to compute the entire top level tree, which involves ...
user avatar
  • 132k
1 vote

Reset Indifferentiability need and it's implications

Motivation The indifferentiabilityframework is a tool to argue the security of cryptosystems under the assumption that the cryptosystem uses an idealized ideal component. Therefore, ...
user avatar
  • 1,333

Only top scored, non community-wiki answers of a minimum length are eligible