37 votes
Accepted

Is it safe to create a public ID by hashing a private key?

Would it be safe to generate a public identifier by hashing this private key? It depends on the hash. If the hash is SHA-512 applied on the private key formatted as a 256-bit (32-byte) string, that's ...
fgrieu's user avatar
  • 141k
35 votes
Accepted

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

"nobody has a rainbow table for [this scheme]" Well, this is a huge claim so needs justification. Building a rainbow table is not hard. Once you are a target, the table will be ready. For ...
kelalaka's user avatar
  • 48.5k
14 votes

Is it safe to create a public ID by hashing a private key?

Remember that Curve25519 is just the elliptic curve. So, if you are mention the private key, it must be set in a certain context - I guess Ed25519 Digital Signature Scheme or X25519 Key Exchange. The ...
Artur's user avatar
  • 160
10 votes

What’s the smallest known sha256 hash that was ever produced?

We can almost certainly say the hash corresponding to the Bitcoin block 756951 (which was mined on 2022-10-04 01:28 UTC) is the smallest SHA-256 hash that has ever been produced: ...
TypicalHog's user avatar
9 votes
Accepted

How to generate n unique numbers from the output of a hash function?

You should use the combinatorial number system to bijectively map an integer in the range 0 to $\binom{16}n-1$ an $n$-element subset of the first 16 numbers. I wrote a related answer on mapping ...
Daniel S's user avatar
  • 23.8k
8 votes

What is the advantage of using hash function families instead of a single hash function?

Actually, it's more about security proof techniques rather than the actual security. When we talk about the security of a cipher (e.g. randomly keyed AES), we want to express it as "there's no ...
poncho's user avatar
  • 147k
7 votes

SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS

What is the motivation of choosing SHAKE256_256 instead of SHA3-256 in XMSS and SPHINCS. For Sphincs+ (SLH-DSA), sometimes there is a need to generate more than 256 bits from a single hash operation; ...
poncho's user avatar
  • 147k
7 votes

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

Is there any possible benefit? The only possible benefit I can see would be if someone picked an enormous password (one so long that there are over $2^{256}$ plausible passwords of that length). In ...
poncho's user avatar
  • 147k
7 votes

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

SHA2(password) + SHA3(password) If by this you mean a concatenation of the two hashes, this actually makes it easier to break. The attacker only needs to have either SHA2 or SHA3 rainbow table ...
jpa's user avatar
  • 328
7 votes

What’s the smallest known sha256 hash that was ever produced?

TL;DR Let's try to estimate this, based on some purported data [if someone has better data they can make the estimate better as well]. There is a claim I read somewhere, that I can't find a link to, ...
kodlu's user avatar
  • 22.5k
6 votes
Accepted

Fast cryptographic hash function for short inputs

[For devices with the AES-NI instruction set] I highly recommend looking at the Davies-Meyer construction based on fixed-key AES. By now, it has been used in dozens of different works, and though it ...
Geoffroy Couteau's user avatar
6 votes
Accepted

How much entropy is lost due to collision?

If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much is entropy reduced after hashing due to collision? With more than say 200 bits of entropy in an ...
fgrieu's user avatar
  • 141k
5 votes
Accepted

theoretical hash collisions vs random number collisions

If I have some pool of inputM values of length M bits (where M is half of N) that are known ...
poncho's user avatar
  • 147k
5 votes

Is it possible to sign in to a website using two different passwords using an MD5 hash collision?

Let's assume that the password hash consists of an 128-bit MD5 hash over the password. Due to the birthday problem there is a >98%† chance that, among 11-characters passwords consisting of ASCII ...
fgrieu's user avatar
  • 141k
5 votes
Accepted

If I hash different seeds with same size of hash output and XOR on plaintext, is it secure as One-time pad?

Will this scheme have the same security of One-Time Pad? Not in theory, facing arbitrary powerful adversaries. E.g. it's overwhelmingly probable that such adversaries could distinguish among two ...
fgrieu's user avatar
  • 141k
5 votes

How certain is it that a shorter password can't match the salted hash of a long one?

[originally posted on security.SE] There's a sister site, crypto.stackexchange.com, that might be better suited to answering your questions about the mathematical properties of hash functions. However,...
CBHacking's user avatar
  • 399
5 votes
Accepted

What is the difference between a seeded RNG and an XOF hash?

More from a programming / pragmatic perspective: I don't like using seeded CSPRNG's to supply deterministic values. That's generally not what they are designed for. They may skip values (buffering), ...
Maarten Bodewes's user avatar
  • 92.6k
5 votes

How much entropy is lost due to collision?

Let's assume that we have a uniform distribution. This is certainly not a given, but usually we assume that hash functions will try and have each output value be equally likely. In that case we can ...
Maarten Bodewes's user avatar
  • 92.6k
5 votes

Citation to original paper by Davies-Meyer on one way compression functions

With a little search; First Handbook of Applied Cryptography; The hash function of Algorithm 9.42 and referred to as Davies-Meyer (as cited per Quisquater and Girault [1019]) has been attributed by ...
kelalaka's user avatar
  • 48.5k
5 votes
Accepted

Should hash salt and public key be a part of cryptographic signature?

This answer merely expands on this comment. is there any good reason to include both salt and public_key as a piece of hash? Reasons to do this include: It's impossible to reuse an existing ...
fgrieu's user avatar
  • 141k
4 votes

Why is domain separation required?

On the first question,the following paper: "Separate Your Domains: NIST PQC KEMs, Oracle Cloning and Read-Only Indifferentiability" touches upon the usefulness of domain separation ...
Marc Ilunga's user avatar
  • 3,188
4 votes

Is every output of a hash function possible?

Actually, it turns out that for all the SHA-3 hashes (SHA3-224, SHA3-256, SHA3-384, SHA3-512) that all hash outputs are possible. The proof relies on the following properties: That the permutation ...
poncho's user avatar
  • 147k
4 votes
Accepted

Bit flipping attack in hash function for message authentication

I believe a counter example could be derived as follows: Suppose that your encryption scheme is a one-time pad, then you have $E(K, M) = K \oplus M$. In your scheme, the output is $(M, E(K, H(M))) = (...
Sacha Servan-Schreiber's user avatar
4 votes
Accepted

What does the 256 in SHA3-256 and SHAKE256 refer to?

SHA3-256 this means the hash will be of 256 bits in length. Is this correct? Yes, that is correct - exactly the same as SHA2-256 means that hash has an output of 256 bits. But, then, what does the ...
poncho's user avatar
  • 147k
4 votes

How to generate n unique numbers from the output of a hash function?

TL;DR: use the Fisher-Yates shuffle based on a seed of the range represented as a list; the hash value is the seed. First of all, MD5 generates 16 bytes that are generally well distributed. It doesn'...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
Accepted

using XOR as a hash function

Well, in this use case (rather than cases which need cryptographic hash functions), what you want is a hash function that, given the distribution of IP addresses you see, assigns each hash result ...
poncho's user avatar
  • 147k
4 votes

Citation to original paper by Davies-Meyer on one way compression functions

Despite what the name may suggest, such a publication simply does not exist. The construction was not proposed in joint work of Davies and Meyer. It appears that the construction was first attributed -...
Maeher's user avatar
  • 6,818
4 votes

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

Whenever you do something that is not standard, you risk that your implementation is broken. Either your scheme is broken on its own, or your implementation allows an attack on a scheme that would be ...
gnasher729's user avatar
  • 1,218
4 votes
Accepted

Random based on video input, why isn't there some predictability

There is definitely some predictability if we take several snapshots back to back of the same image. However, if we wait a few seconds, there's still probably enough entropy to extract from the image ...
bk2204's user avatar
  • 3,361
3 votes

Can I check if a PGP signed message has been modified when I don't have the public key

There is no cryptographically sound method to check if a PGP signed message has been tampered with† when the public key of the signer is not available. Argument: an adversary can craft any message ...
fgrieu's user avatar
  • 141k

Only top scored, non community-wiki answers of a minimum length are eligible