268 votes

Why can't we reverse hashes?

Take a simple mathematical operation like addition. Addition takes 2 inputs and produces 1 output (the sum of the two inputs). If you know the 2 inputs, the output is easy to calculate - and there's ...
adelphus's user avatar
  • 2,284
151 votes
Accepted

Has SHA256 been broken by Treadwell Stanton DuPont?

[Update, 2019-09-12: Upon being exposed, and/or after taking advantage of market manipulation by their fraudulent announcements, the scam artists of Treadwell Stanton DuPont have retracted their claim,...
Squeamish Ossifrage's user avatar
133 votes

How do hashes really ensure uniqueness?

The simple answer is that hashes don't ensure uniqueness. Very broadly, hashes behave like "deterministic random numbers" – deterministic in the sense that hashing the same data always ...
David Richerby's user avatar
109 votes
Accepted

What is the difference between a digest and a hash function?

The digest is the output of the hash function. For example, sha256 has a digest of 256 bits, i.e. its digest has a length of 32 bytes. That's it really.
Awn's user avatar
  • 1,562
85 votes
Accepted

What is the new attack on SHA-1 "SHAttered" and how does it work?

In order to get a collision on a $n$ bit Random Oracle using the birthday paradox, one needs $\sqrt{\pi / 2} \cdot 2^{n/2}$ calls. In other words, in the case of the 160 output bits of SHA-1 the limit ...
Biv's user avatar
  • 9,989
70 votes

Are there two known strings which have the same MD5 hash value?

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. ...
Silverfox's user avatar
  • 871
70 votes
Accepted

Can a large file be hashed down to 32 bytes, and then reconstructed from the hash?

No, there is no way to compress (or hash or encrypt or whatever) a 5 MB file into a 32 byte hash and then reconstruct the original file just from the hash alone. This is simply because there are many ...
Ilmari Karonen's user avatar
69 votes
Accepted

Other than password hashes, are there other uses for non-reversible crypto

Data integrity is another usage. For example, when you want to send/download data, you want to make sure that the data is not modified or transmitted/downloaded correctly. To achieve this the data ...
kelalaka's user avatar
  • 48.5k
66 votes

Cryptography algorithms that take longer to solve on a GPU than a CPU

This specific situation is a central part of the analysis of password hashing functions. Indeed, for hashing a password, we want a function which is: slow in a tunable way; such that the most cost-...
Thomas Pornin's user avatar
60 votes
Accepted

How can hashes be unique if they are limited in number?

how can for example SHA-256 be unique if there is only a limited number of them?! Where your issue occurs is that they're not unique. It's just very improbable that they'll reoccur. Unique in ...
Paul Uszak's user avatar
  • 15.4k
56 votes
Accepted

How secure is SHA1? What are the chances of a real exploit?

Actually SHA-1 has been "officially insecure" for a longer time, since an attack method was published in 2011. The 2017 collisions was just the first known case of actually running the attack. But ...
Thomas Pornin's user avatar
56 votes
Accepted

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

This answer is based on the work by AleksanderRas, although my conclusion is different. First, to lay out a definition, a hash is a function that takes an arbitrary length input to a fixed length ...
Josiah's user avatar
  • 1,032
53 votes
Accepted

Is it bad to expose the public key?

From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a ...
fgrieu's user avatar
  • 141k
53 votes
Accepted

Can I say "I have encrypted something" if I hash something?

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions. As stated on Wikipedia: In cryptography, ...
AleksanderCH's user avatar
  • 6,445
47 votes
Accepted

Are cryptographic hash functions quantum secure?

It is a bit dubious to claim that hash functions "are not based on any hard problem": inverting a standard hash function, or finding a collision, is itself a very hard problem. The point of ...
Geoffroy Couteau's user avatar
45 votes
Accepted

Why do I need to store the salt for generated hashes?

The hash returned by bcrypt.hashSync is more than the hash itself, it contains all parameters needed by bcrypt. You do not need to store anything else yourself, ...
Marc's user avatar
  • 1,583
45 votes
Accepted

Does Terra Quantum AG break AES and Hash Algorithms?

The onus is on the company to prove their claims, especially when they are extreme. There is also no financial motivation to not prove their claims. I can understand if they say that they want to keep ...
Yehuda Lindell's user avatar
42 votes
Accepted

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
otus's user avatar
  • 32.1k
42 votes

Why can't we reverse hashes?

Cryptographically secure hashes were specifically build to (among other things) make what you're asking hard! Now, you could try to create an appropriate dictionary of all hashes, hoping to find ...
e-sushi's user avatar
  • 17.9k
38 votes
Accepted

If a hash function $H$ is collision resistant, is it true that $H(x)\neq H(x')$ for all messages $x, x'$ with $x \neq x'$?

As you correctly observed, for any function $H\colon \{0,1\}^\ast\to\{0,1\}^n$ collisions must exist, simply because $\{0,1\}^\ast$ is an infinite set and $\{0,1\}^n$ is finite. One could define "hash ...
yyyyyyy's user avatar
  • 12.1k
38 votes
Accepted

Why use argon2i or argon2d if argon2id exists?

The current Argon2 draft RFC, I think, provides a good, reasonably brief answers to this question. TL;DR: most people will indeed want to use Argon2id and not the "pure" variants. The ...
Luis Casillas's user avatar
37 votes
Accepted

What are the odds of collisions for a hash function with 256-bit output?

Birthday problem for cryptographic hashing, 101. Let $p_n$ be the probability of collision for a number $n$ of random distinct inputs hashed to $k$ possible values (that is, probability that at least ...
fgrieu's user avatar
  • 141k
37 votes

Has SHA256 been broken by Treadwell Stanton DuPont?

This is firmly in "put up or shut up" territory. It's easy to prove this claim. I will provide them with a string and its hash. They must provide a collision. They could also mine bitcoin and earn a ...
Adam Ierymenko's user avatar
37 votes
Accepted

Is it safe to create a public ID by hashing a private key?

Would it be safe to generate a public identifier by hashing this private key? It depends on the hash. If the hash is SHA-512 applied on the private key formatted as a 256-bit (32-byte) string, that's ...
fgrieu's user avatar
  • 141k
35 votes

Is it easy to crack a hashed phone number?

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the ...
Maarten Bodewes's user avatar
  • 92.6k
35 votes
Accepted

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

"nobody has a rainbow table for [this scheme]" Well, this is a huge claim so needs justification. Building a rainbow table is not hard. Once you are a target, the table will be ready. For ...
kelalaka's user avatar
  • 48.5k
34 votes

What is the maximum size of the plaintext message for RSA OAEP?

Important note: usually OAEP is only used to encrypt a random symmetric key, which is then used to encrypt a plaintext message; this is called a hybrid cryptosystem. Repeated use of OAEP would require ...
Maarten Bodewes's user avatar
  • 92.6k
34 votes
Accepted

Is there really no use for MD5 anymore?

I know that MD5 should not be used for password hashing, and that it also should not be used for integrity checking of documents. There are way too many sources citing MD5 preimaging attacks and MD5s ...
Squeamish Ossifrage's user avatar
34 votes
Accepted

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

Define $H(x) = \operatorname{SHA-256}(x) \mathbin\| 1$; that is, append a single 1 bit to SHA-256. Can you find a collision under $H$? Does $H$ have anything resembling uniform distribution? This ...
Squeamish Ossifrage's user avatar
33 votes
Accepted

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64. Sometimes ...
Maarten Bodewes's user avatar
  • 92.6k

Only top scored, non community-wiki answers of a minimum length are eligible