Hot answers tagged

46

The onus is on the company to prove their claims, especially when they are extreme. There is also no financial motivation to not prove their claims. I can understand if they say that they want to keep their new "unbreakable algorithm" secret until they patent it, but what reason in the world would there be to not present a break? This is especially ...


20

Strictly speaking, all hash functions are compressing since the output can be smaller than the input, but I imagine you're asking about compressing data that can later be losslessly decompressed. This is impossible due to the pigeonhole principle. The fact that the fixed output space of a hash algorithm is smaller than the input space means that there will ...


15

Edit 2021-02-10: covering now their latest press release Red flags While the details of their work/claims are yet to be published, this article is containing a lot of conspicuous statements. Vinokur said in an interview that Terra Quantum’s team made the discovery after figuring out how to invert what’s called a “hash function,” This would be a major ...


10

If the question was about (current form) Reversible cryptographic hash functions Then No! One-wayness property of the cryptographic secure hash functions will prevent that. Hash functions don't use keys. So if you can reverse, everybody will reverse and there will be no secure hash function at all. Besides, mathematically impossible, too; hash functions use ...


9

There is also a non cryptographic alternative. From their site :- "IP and legal rights" suggests that they are IP savvy. They may be after a patent for an attack algorithm/appliance against symmetric ciphers. Much like Terahash appliances and cell phone interceptors. A patent award requires that the applicant:- Demonstrate aesthetic design or ...


7

It clearly reminds me of the Treadwell Stanton DuPont story. Just to add some numbers on the current state-of-the-arts methods on these topics : the best quantum known attack on complete AES is using Grover (which is still $2^{138.8}$ in its 256-bit version, using 2k+ qubits). As far as I know, the best quantum attacks on reduced-rounds AES are barely ...


6

In 2006, Mihir Bellare, in their article New Proofs for NMAC and HMAC: Security without Collision-Resistance proved that if the compression function is a PRF then HMAC is a PRF ( this is a short story, see below). As a result, HMAC like HMAC-MD5 does not suffer the weaknesses of MD5. However, still prefer HMAC-SHA256 or KMAC of the SHA-3 series. Keep ...


5

You don't get empty output in AES, too. AES is a permutation and will always return a plaintext, correct or not depending on the key. If I take the SHA3_512 of the Argon2ID-ed password and include it with the ciphertext, is the ciphertext now vulnerable to attacks? One needs to find a pre-image to the key, and normally the cost of this is around $2^{512}$ ...


4

You can't completely precalculate 1111, however, you can completely precalculate messages that have a length multiple of 512. The reason is simple, SHA-256 uses 512-bit message block per compression, i.e. the compression function of SHA-256 uses 512-bit message inputs and 256-bit previous hash values. $$C:\{0,1\}^{256}\times \{0,1\}^{512} \to \{0,1\}^{256}$$ ...


3

This is a valid paradigm for building a signature scheme, although a secure commitment scheme should be used to commit to $k$ instead of just using $H(k)$ as the public key. This type of construction was published by Bellare and Goldwasser at CRYPTO'89; see New Paradigms for Digital Signatures and Message Authentication Based on Non-Interactive Zero ...


3

The hyperbole is jaw-dropping: Advanced Quantum Domination, in the link Mr. Bodewes shared. Terra Quantum AG is a little low on self-doubt: Terra Quantum is a deep tech pioneer, developing revolutionary quantum applications to shape the technology of the future. Our international team of experts brings together the best minds from science, academia and ...


2

For simplicity, if I assume a single block of message, then how do I use this universal function to evaluate the hash? We shift some parameters from being part of the concrete function instance into the key. For your example of $h_{ab}(d)=ad+b\mod p\mod m$ the following mapping is usual: $d$ is the input to be hashed $a$ is the secret key of the ...


2

BLAKE2 can be used as a drop-in replacement for SHA-256d, yes. It is not vulnerable to the length extension attack. Whether or not you should use it in cryptocurrency is a more complex question, but it suffices to say that it will not be any less secure than using SHA-256d for your purposes. Regarding the speed comparison, this will be more complex to answer ...


2

As a somewhat indirect answer to the question, notice that the company's publication list currently appears to be padded out with papers in cardiology(!), which does not inspire confidence in their reliability. (Their staff list used to include some people I was familiar with, but they appear to have scaled it down to only the "leadership team", ...


2

How does this attack alter the runtime analysis for brute forcing hash collisions? If you care only about runtime, it states that you can reach $t\approx2^{b/6}$ (b=output bit size of the hash) on non-quantum dedicated hardware, if you give it enough cores. Still, it's not a new result of that paper. how big are hashes going to balloon to? If you mean a ...


2

The C#/.NET GetHashCode() is not a cryptographic hash function. As a non-cryptographic hash function I think what you've written is reasonable assuming that X and Y are the only "public" properties that make up the object. Having said that, cryptographic hash functions are very different both in implementation and purpose than C#/.NET/Java hash ...


2

Is there any way to derive a series of asymmetric keys, such as using a one-way hashing function, where both sides can predict the next in the sequence? Here is one way, based on elliptic curves (or finite field based on discrete logs); one such public key encryption method is the Integrated Encyption Scheme. Now, it does have the drawback that if the ...


2

rsa_pss_rsae_sha256 is the signature scheme that defines to use of the SHA-256 during the RSA-PSS signature algorithm. Since Rabin-Signature Scheme, which is the first true signature scheme, the security of the signature is a part of the hashing a message and that enables us to sign arbitrary long messages, too. The rsa_pss_rsae_sha256 will use SHA-256 to ...


1

Not necessarily; this varies from signature scheme to signature scheme. In some lattice signature schemes (e.g. FALCON) it is important not to produce two signatures for the same private key and hash value. In the case of FALCON it is therefore specified that the message be randomly salted before hashing and signing (see section 2.2.2 of the FALCON ...


1

As Uraguan mentioned, the amount of effort required to break this scheme is proportional to the size of the keyspace. There are two limiting factors here. One of these factors is that anybody who learns the master key can extract the others trivially. So at most, your keyspace can be 256 bits in size, since any attacker will have to at most try $2^{256}$ ...


1

The security is considered to be proportional to the size of the keyspace. In your proposal, the keyspace is not increased by adding encryption layers since all keys are derived from a single password. In the proposed case Hashes are not mutually independent keys since they are derived from a single password. If they are derived from separate password then ...


1

There is no proof, there are only advancements. BLAKE2 is not completely MD, it is HAIFA which extends the MD to eliminate the problems and and BLAKE3 is a parallel hash. Quamtum collision attack costs The best know a generic quantum collision is the takes $\mathcal{O}(2^{n/3})$ time due to Brassard–Høyer–Tapp (BHT). It is usually advertised (even by the ...


1

are there more efficient ways to generate the authentication path without recomputing the xmss root? Yes (and without using large amounts of memory to store the entire tree). These are Merkle tree walking algorithms; these are algorithms which output the 'next' authentication path for a Merkle tree - they store some number of internal nodes, and recompute ...


1

The encoding doesn't change the output of the entropy source. They are reversible operations. You can use what encoding suits you, change to base64 for transmission and strong on the database, and change to byte is a good choice since, in general, the cryptographic hash functions are accepting bytes to process, so it might better to convert them bytes before ...


1

If you look at the specification to understand how those constants were chosen, you'll realize you waste more memory generating them "on the fly". SHA-256 compression function key schedule constants are calculated as the fraction part of cubic-root of the first 64 prime numbers. You said you coud delete them after use (in the comment), but wouldn't ...


Only top voted, non community-wiki answers of a minimum length are eligible