# Tag Info

33

Define $H(x) = \operatorname{SHA-256}(x) \mathbin\| 1$; that is, append a single 1 bit to SHA-256. Can you find a collision under $H$? Does $H$ have anything resembling uniform distribution? This counterexample is not merely pathological; designs like Rumba20 and VSH provide collision resistance but neither preimage resistance nor uniformity. That said, ...

5

Not every company hashes passwords properly and not everyone chooses secure passwords. If you hash them poorly (i.e. if you do not use a password hash with salt, and simply use SHA-256), then you can use a dictionary attack where you hash a list of common passwords and compare them to the leaked hashes and try to find any matches. This way, you can "invert" ...

5

Users have a habit of choosing passwords badly so that they can be guessed much more easily than cryptographic keys, requiring (say) only a trillion ($10^{12} \approx 2^{40}$) guesses on average instead of a duodecillion ($10^{39} \approx 2^{128}$, or thousand sextillion in the long scale) guesses on average. Users also have a habit of reusing passwords ...

4

You've asked for a way to hash a file into a short string $h$ so that given a partial download $c'_0 \mathbin\| c'_1 \mathbin\| c'_2 \mathbin\| \cdots \mathbin\| c'_{i-1}$ of the file that should start with $c_0 \mathbin\| c_1 \mathbin\| c_2 \mathbin\| \cdots \mathbin\| c_{i-1}$ but may have been modified in transit, you can compute some verification ...

4

They are not. First of all, $\{0,1\}^*$ and $\mathcal{G}$ are not "values", they are sets. $\times$ does not mean multiplication, but the Cartesian product of those sets. Second of all, those are not definitions of functions. All that's specified there is the domain and range of the hash functions. Specifically $H_1$ maps tuples $(a,b,c)$, where $a\in\{0,1\}^... 4 There is no international committee on which function / term is correct or not. Work factor seems to be a more generic term, and I'd prefer that when talking about the relative amount of work that needs to be performed. That - at least internally - an iteration count is used together with a hash algorithm is an implementation detail. The work factor doesn'... 3 No, but high collision resistance per bit has an influence. Non-uniformity -> less entropy -> weakned collision resistance. As keysize is significant factor: most cryptographic hash functions have uniform output given entropic input. Using a hash (or encryption) routine to make a stream of random numbers from a single block of entropy is an established ... 3 I am telepathically inferring you're talking about Java here, in which: Random is a linear congruential generator with a 48-bit seed and no security properties whatsoever, and SecureRandom is some cryptographic algorithm whose documentation (archived 2019-03-23) is unclear about its security properties, with broken links and archaic references, but of which ... 2 A brief description of such functions can be found in chapter 9.3 of the paper “Cryptographic Hash Functions: Recent Design Trends and Security Notions” (eprint.iacr.org/2011/565). The following excerpt is taken from page 29 of the paper: Hash functions based on chaos theory use chaotic maps, which are functions that exhibit particular chaotic behaviours;... 2 To understand the mechanism, you could refer to the one of the simplest and dumb hashing method that everyone knows, the arithmetic$modulo$operation. Different-length input numbers produce the same-length results through$mod$. For example: if we want only$8$-bit output values, we choose$2^{8}$as modulo divisor we could simply choose$4$input ... 2 Suppose a signature is not an integer$s$such that$s^e \equiv H(m) \pmod N$, but rather a pair of integers$(s, k)$with$s < N$and$k < N^{e - 1}$such that $$s^e = H(m) + kN.$$ Then the verifier can verify this equation modulo a secret uniform random$v$-bit prime$r$, $$s^e \equiv H(m) + kN \pmod r.$$ There are$\pi(2^v) - \pi(2^{v-1})$such ... 2 Iteration count is a parameter that you can choose directly; likewise memory use and parallelism for other password hashes like Argon2. These should be tuned according to the user's available resources: how many CPU cores they can use in parallel to log in, how much memory they can use while logging in, and how many seconds they are willing to wait for ... 1 Regarding the IVs and round constants of hash functions... The question for SHA1 and SHA2 families have already been answered. Rotational constants were chosen by the designers to make the hash functions secure (or in the case of SHA1, not secure enough). Derivative hash functions such as SHA-224 and SHA-384 use different initial values which are simply the ... 1 I thought of it because nowadays we do not have computational power to break those hashes, so how can a criminal use those hashes against the users? Breaking a hash algorithm requires a pre-image, second pre-image, or collision attack that is cheaper than brute force. (For full or partial outputs.) More generally, a broken algorithm is any algorithm for ... 1 It is certainly possible for a string to contain its own hash value, so it's even possible that$s_0 = s_1\$. And it's even possible to artificially construct functions that satisfy all the standard properties required of a cryptographic hash function (i.e. collision and first and second preimage resistance), but which hash an arbitrarily chosen string to a ...

1

A salt is required to be unique. While it wouldn't be a major issue to not use a cryptographic random number generator for creating a salt, it is still good practice to do so. I would recommend you use SecureRandom or an equivalent function for this task, if for some reason you are unable to use an existing, secure library to abstract all of this away and ...

1

This is the mechanism of the rolling system of one of the best known crypto faucet website. I think that the previous answer above is a bit misleading. However, when the math is confusing, a simple test with some code and some pseudo-random generated data should not leave any doubt. Your statement: "..the way I see it, it is 50% less likely to hit the ...

Only top voted, non community-wiki answers of a minimum length are eligible