New answers tagged

0

Based on the example given in the question (see here) the following (hex-encoded) bytes would be hashed: From the Public-Key Packet Ciphertype Byte: 99 Key Length: 01 0d Version: 04 CreatedAt: 5e f4 a2 c6 Algorithm: 01 n (with tag): 08 00 a8 14 6d b3 75 12 72 33 1e 92 54 c5 43 f6 44 d2 22 5d 4d 9b 0c b8 5d 60 60 8b f0 39 08 1e 31 29 e2 f5 4c 83 e0 ...


0

Collision resistance is usually a property of hash-functions, would that also be a proper term to describe block-ciphers? Well, kind of. The message space of a hash function is huge. It contains about 2 ^ 2 ^ 129 separate messages for SHA-512, for instance. So it will have collisions as the output size is limited to 512 bits. On the other hand a keyed block ...


0

What you want is the below query is possible but the database is secure against; Frequency/Inference attacks Select * FROM users WHERE 'fav_color' = RED What we have; small values space for the color names as people's favorite colors. We can consider this is as an example of the small message space like gender, age, weight, scale, the illnesses they have, ...


1

As you mention, phone numbers have low entropy. Someone who "doesn't know" a phone number at the time of the proof can easily obtain the phone number later. You won't be able to find a non-interactive solution to this problem -- an attacker can always run a dictionary attack and use your "proof" as a test for whether they've found the ...


2

An alternative is to encrypt the phone number as proposed in the previous answers. For example, Mobile connect identity service encrypts the MSISDN (aka phone number) using a specific algorithm. This GSMA specification gives information about decoding the payload : Following are the example of encrypted MSISDN passed: with URL encoding: login_hint=...


1

However in the case of a private set intersection we can use a secret key $s$, so if I am correct the discrete logarithm of $h(m) *s$ would not be known : That is correct; it is not known; however that is not sufficient; the relationship between $h(m_1) * s$ and $h(m_2) * s$ would be known (if you know $m_1, m_2$), and that breaks security (at least, within ...


9

In the general sense, The problem is known as the small input space on the hash functions, and in short simple hashing won't be secure. If you hash data ( here a phone number) and an attacker tries to find an input value that matches the hash value is called the pre-image attack. In a secure Cryptographic hash functions pre-image attack requires $\mathcal{O}(...


12

It is always a bad idea to hash data that has a limited set of length or characters. A phone number in Germany for example has normally no more than 12 digits. The first digit is always a 0 and the vast majority of numbers is longer as 3 digits, as those are normally reserved for emergency services. This effectively leaves us with 10^11-10^3 possible ...


7

As an alternative, you can salt the phone numbers to avoid pre-calculation attacks. A known salt will help against an adversary who has already done a hash of all possible phone numbers but just adds one order of magnitude of work (the adversary just has to recalculate all the hashs with the salted phone numbers). If you can keep the salt private raises the ...


30

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the hash of each with the stored hash. Generally you don't have to deal with all telephone numbers, only a subsection of phone numbers anyway (for a specific country ...


4

Would there be any additional benefit to this scheme? Not really; password hashing is storing the hashed password in this form: $$H( \text{password}, \text{salt} )$$ where $H$ is some hard-to-compute hash function. What you are suggesting is to replace this with: $$H( \text{password}, D( \text{password}, \text{encrypted_salt}) )$$ (where $D$ is the ...


-1

Hash = A result of a mathmatical function that is difficult to reverse engineer. The result of applying hash to a text is a long code. Examples of hashes: MD5, SHA1. The length of MD5 code is 128 bits, the length of SHA1 code is 160 bits. With a hash: You cannot revert back to the original message. But the same message will always give the same hash. So if ...


0

From the FIPS 202 defines the padding. Multi-rate padding : The padding rule $pad10*1$, whose output is a $1$, followed by a (possibly empty) string of $0$s, followed by a $1$. The padding rule, pad, is a function that produces padding, i.e., a string with an appropriate length to append to another string. In general, given a positive integer $x$ and a non-...


4

What happens, when we want to put a message of 575 bit into the algorithm? Obviously we are 1 bit short of the required length, and the padding rule is at least 3 bit long. What happens in that case? In that case, we just extends padding until it hits the next multiple-of-576 boundary; in this case, this means the padding is 577 bits long (and crosses the ...


0

This is a pure encoding problem, as @kelalaka said. Take any reasonable hash algorithm like SHA-512. You have all qualities that you mentioned - not reversable, low probability of collisions, etc. What needs top be done, is to encode this hash into a picture. To algorithm: look for instance at automatic generation of avatars at Stack Exchange to get one of ...


1

The combination of different schemes may be somewhat advantageous with regard to certain custom hardware (ASICs), but I think that the disadvantages outweigh them. I assume that there is some kind of fixed time that is acceptable to the user. Nobody will use a procedure where she or he has to wait several minutes. Modern password hashing schemes are ...


8

Yes, you can create many such functions. For instance, lets build such a function based on SHA512. Generate some random value $m_0$ and generate a hash of it. It is important, because there is no guarantee that every 512-bit number has a pre-image. So, let $h_0 = \operatorname{SHA512}(m_0)$. After hash generated, throw $m_0$ away. Technically you can do that ...


4

So suppose we define our encryption scheme as follows: $E(K, M) = \operatorname{CTR}(K, M || H(M))$, where $H$ is a hash function (e.g., SHA2-256), and $\text{CTR}$ is the counter mode-of-operation of some underlying blockcipher (e.g., AES-128). Now suppose we observe the ciphertext $C = C_M || C_T $ of a known message $M$ and want to modify some bits in $C$ ...


2

While SHA2 (SHA-256, SHA-512) original design goals are limited to collision-resistance and (first and second) preimage resistance, it is not known that its computationally distinguishable from a random oracle for messages of fixed length¹. Thus $\text{SHA2}(\text{seed}+n)$ for incremental $n$ is a CSPRNG as far as we know, for a wide-enough random secret ...


1

Note: The attacks you refer to in that thesis are structural attacks, I will consider the complexity of a brute force attack, which would be applicable to any hash function $H$ which is well designed, approximating a pseudorandom function. There are some good answers here on the complexity of the birthday attack on a hash function, which is $O(2^{n/2})$ for ...


1

Is it a good idea [from a security perspective] to use the first 16 bytes of SHA-1 (20 bytes long) as IV? It depends. For CBC, the main requirements is the IV are that it should be unpredictable for the attacker. In particular, you should never ever use the same IV more than once for encrypting messages under the same key. This implies that, in your system, ...


0

It seems we can use commitment schemes with homomorphic hiding and binding properties here. Often these commitment schemes are used for secure multiparty computation, and zero knowledge proof generation purposes. A commitment scheme is a cryptographic primitive that allows one to commit to a chosen value (or chosen statement) while keeping it hidden to ...


7

What needs to be memorized in applied science (physics, crypto) is not a set of formulas. It's, for a few of the simplest formulas studied: what the formula yields, for what inputs, the units for inputs and output, and how to derive the formula when it does not boil down to multiplying or dividing the inputs in a way that can be found from the units. When ...


4

You're wrong. Hint: a value of 8 bits has 256 possible values, not 8.


4

Is there a signature scheme in which $\text{signature} = \mathsf{Sign}(\text{message} \mathbin\| \text{signature})$ ? With standard RSA signatures (RSASSA-PKCS1-v1_5, RSASSA-PSS of PKCS#1), that's possible if one chooses the public/private key pair for that purpose, as a function of the message. On top of that one can even make the signature nearly anything ...


Top 50 recent answers are included