Hot answers tagged

29

a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones. We might consider other constructions which may provide some strength e.g $H(H(m) || m)$ however: b. We have no need for any such double hashing of SHA1 as we have newer ...


10

HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the underlying hash is itself a PRF. HKDF follows the "extract-then-expand" paradigm, where the KDF logically consists of two modules. The first stage takes the input keying material and "extracts" ...


9

To answer every part of this question in full details would require almost a book. Here, I’ll attempt to address all sub-questions and give a brief summary together with pointers each time. If you want me to develop some specific aspect, you can ask in the comments. Most of what I will say will not be specific to proving knowledge of a SHA-256 preimage, but ...


6

SHA-1, like the earlier MD5 and SHA(-0), and the later SHA-2, is built per a carefully devised hierarchical design: Merkle-Damgård at the outer, building a collision+preimage-resistant hash with a security argument based on a fixed-width compression function. Davies-Meyer to build that compression function, with a security argument based on a block cipher ...


5

We can consider Merkle-Damgard(MD) based hash functions like MD4, MD5, SHA-1, SHA-256, SHA-512, and derivatives as a rotated block cipher, where the key is the message and the input is the previous state. A bit more formally, for SHA-1, there is a block cipher, named SHACAL, that takes a 512-bit key and 160-bit block as the input. Then the MD construction ...


3

The BLAKE3 hash function was just announced today. Internally, it's a Merkle tree.


3

Generic collisions The generic collision attack on SHA-512 trimmed to $n=160$-bit will require $2^{80}$ complexity by the birthday paradox with a 50% success probability. The generic attack doesn't require any knowledge about the internals of the target hash function. It is about collecting hash outputs and looking collision among them by building a table ...


2

There is the idea of a fuzzy vault, a coding theory based idea first proposed by Juels, developed for biometric applications, it warrants a look. Start at Wikipedia. These notes below are excellent: https://wiki.cse.buffalo.edu/cse545/content/fuzzy-vault


2

If you know the sender's verification key previously: Yes, it does prove the authenticity and integrity of that message. No one else could have created a matching signature - for any message under that public key. As a side note: hashes of files are in theory a good idea to check that it was not changed. But when you get the hash from the same source as the ...


2

I'm reading the question as: Prover knows a message (thus its SHA-256 hash, and message length), and position+length of a substring (thus the substring). Verifier knows the hash, the substring and its position (thus length), and message length. Prover should demonstrate knowledge of a message with such SHA-256 hash and length and with such substring at ...


2

I disregard the perfect hash requirement. In the application asking for preimage-resistance with a narrow hash, one should use a purposely-slow memory-hard hash (as used for passwords, also known as key-streching or password-based hash). This greatly reduces the number of bits needed for preimage resistance. More precisely, we want to build a hash that ...


2

It's certainly better to move to a modern hash function without significant known weaknesses than to stick with one that is known to be broken. Furthermore using a larger state for the hashing process helps mitigate certain attacks, even if your output size is limited. In an ideal world you would make the system support longer hashes, but if the choice is ...


1

This is the pre-image attack on hash functions, i.e. pre-image attack : given a hash value $y$ find a pre-image $x$ such that $y=h(x)$. Good designed cryptographic hash functions have $\mathcal{O}(2^{n})$ classical pre-image resistance for $n$-bit output. The classical attack tries all possible input space to find a $x$ that hashes the target hash value. ...


1

where "1234" is the result of hashing "foo", and "6%!*3" is the encryption of "bar" using "foo" as encryption key (or something along those lines, I'm afraid I don't know much about encryption - what I mean is that it should be possible to use the string "foo" to decrypt "6%!*3"). So you want to encrypt the usernames, then use the username as an encryption ...


1

What your describing is the core of many password hashing algorithms like bcrypt or pbkdf2. However, these are all complicated functions which don't just iterate. They are very commonly used with salt. If you would hash a password as you described n times, a reasonable choice would be bigger then 100.000. However this is only for storing the password. If ...


1

In a chosen-prefixes collision attack, the adversary is able to freely choose two distinct prefixes $P$ and $P'$ of arbitrary content, and is able to find suffixes $S$ and $S'$ with $H(P\mathbin\|S)=H(P'\mathbin\|S')$.Note: It is common to write chosen-prefix when that logically should be chosen-prefixes. In other types of collision attack the adversary ...


1

By all accounts SHA-512/160 is more secure than SHA1. The only question is it secure enough? If you are only worried about preimage or second preimage resistance the answer is yes. 160 bits should be sufficient for the forseeable future even faced against powerfull adversaries. If you need collision resistance the answer gets more complicated. There are no ...


1

The MAC under attack is built from a hash $h$ (assumed to process a hashed message by splitting it in blocks processed only once, as most hashes do), with a key split into $K_1$ and $K_2$ of equal size. It computes the MAC of a message $x$ as $$\operatorname{MAC}_{K_1\mathbin\|K_2}(x)=h(K_1\mathbin\|x\mathbin\|K_2)$$ The attack in the paper recovers $K_1$ ...


1

It depends a lot of why you want to do this and for what types of hashes and input data but I would think that for some purposes it may be sufficient to do so through sampling, though you would certainly want to be careful about how much you trust this sort of analysis depending on how you're using the hash values. For example, if you know that the data you'...


1

Actually, lecturers/professors build simplified version of block ciphers and hash functions so that the students can understand better. For Block ciphers there are; Simplified DES by Edward Schaefer in 96. You can also set it in Stinson's book Appendix G. Simplified AES is first appeared on Cryptologia, 2003 by Musa, Schaefer, and Wedig. Another ...


1

As stated in other answers, yes revealing $y=\operatorname{SHA-256}(\mathrm{secret}\mathbin\|\mathrm{known\_constant})$ in addition to $x=\operatorname{SHA-256}(\mathrm{secret})$ gives extra information about $\mathrm{secret}$. That has both theoretical and practical implications. From a theoretical standpoint, that's very likely to reduce the number of ...


1

Is this possible using the same message? No. But the message / input for SHA-256 is defined as a bit string, which - for most implementations - means an octet string, also known as a byte array. Of course, in practice, this usually means that the function has one or more update methods that accept bytes, and a method that finalizes the input, so that the ...


1

One hexadecimal digit is of one nibble (4 bits). Two nibbles make 8 bits which are also called 1 byte. MD5 generates an output (128 bit) which is represented using a sequence of 32 hexadecimal digits, which in turn are 32*4=128 bits. 128 bits make 16 bytes (since 1 byte is 8 bits).


Only top voted, non community-wiki answers of a minimum length are eligible