# Tag Info

### Rewarding the finding of zeroes of a hash function

What you describe is witness encryption. In normal encryption, you encrypt a payload so that anyone with the corresponding decryption key can read it. In witness encryption, you encrypt so that anyone ...
• 13.6k

### Why is the sum of hashes not a proper homomorphic hash function?

I believe this shows that the scheme is a lot less secure than the original hash function $H$, with a security parameter only proportional to the square root of the output size of $H$, in the ideal ...
• 49
Accepted

### How to make a function which produces a hash of variable length?

This is the keystream generation step of a stream cipher, using a password as key. As far as I understand, it hashes the password using SHA-512, then expands the 64-byte result by rehashing every 32-...
• 142k

### How to make a function which produces a hash of variable length?

As I understand the question, the intent is to use a "password" as a key, and expand this key by generating a series of hash values and concatenating them to be used as keying material for ...
• 49

### How to make a function which produces a hash of variable length?

I too play with OTPs. I use batteries, diodes, cameras and a soldering iron. I also leverage the Left Over Hash lemma producing $\epsilon < 2^{-10,000}$. And it is slow. Yet I don’t have a ...
• 15.6k

### Why is the sum of hashes not a proper homomorphic hash function?

The issue here is that even if the distribution of $H$ is uniform (which is the ideal that we aim for), the distribution of $\sum H$ is not. Thus if $n=2$ the distribution is triangular and as $n$ ...
• 24.1k

### Why does HMAC-SHA1-96 need to pad message to a multiple of 160 bits?

The source quoted in the question contradicts the relevant RFC 2404, The Use of HMAC-SHA-1-96 within ESP and AH, which states there is no need to pad the input data: HMAC-SHA-1-96 operates on 64-byte ...
• 142k

### Why does HMAC-SHA1-96 need to pad message to a multiple of 160 bits?

AH-HMAC-SHA1 does not add any padding to the message it authenticates; I believe the text you are quoting is in error. One possibility: perhaps the author you are citing misunderstood section 3.3.3.2....
• 148k

### Which MACs can be converted into a secure unkeyed hash function?

As pointed out by others, MAC systems based on hash functions can trivially be made back into hash functions by making the key a public constant. E.g. $hash(msg) = HMAC(key_{const}, msg)$. It's also ...
• 705

### How can a attacker find a collision of a keyed digest without knowing the key? Are collisions not an issue anymore if we apply a keyed-digest?

Without further restrictions on the definition of “collision,” we can find several examples of easy collisions in keyed hashes. It all comes down to what capabilities the adversary is allowed to have. ...
• 3,338
1 vote

### How can a attacker find a collision of a keyed digest without knowing the key? Are collisions not an issue anymore if we apply a keyed-digest?

Keyed Hashes require a key to process to apply the generic collision search. This is not possible since the attackers don't have the key. If they have the key, collision is your least concern. ...
• 49k