The Stack Overflow podcast is back! Listen to an interview with our new CEO.

New answers tagged

1

440 and 888 are the maximal values of seed length, that, when concatenated with 1 octet, yields a input to SHA256 and SHA512 respectively, requiring only 1 invocation of the compression function. These values are fixed in such way that, it precludes the use of other hash functions, even ones approved as SHA3. However, if one wants, the above rule can be ...


0

The Schnorr signature scheme is the weak Fiat-Shamir transformation of the Schnorr identification protocol. In a group G of order q generated by G, it proves knowledge of an exponent x satisfying the equation X = G^x for a known X. Viewing (x, X) as a signing/verification key pair and including a message in the hash input yields a signature of knowledge. To ...


1

I think you have the verification of Fiat Shamir wrong. The proof consists of $(h,r)$ and $y$ which is public anyway and only the relation $h = H(y,g^r y^h)$ is checked. As a result in your first case the proof is trivially valid. Your second case is interesting as it is not secure against an adaptive adversary. There is a paper by David Bernhard, Olivier ...


2

The key derivation process you describe is reasonably secure in a technical sense, but not a good choice—it's not very flexible, it will raise auditors' eyebrows, and SHA3-512 is just not a good design. Security if we model SHA3-512 as a uniform random function $H$: Each of the 512 bytes of $H$ on distinct DH secrets is independently uniform random, so the ...


1

The easiest way maybe is running a single SHA-512 or SHA3-512 and split the result into half. $$\text{AES-KEY}\mathbin\|\text{KMAC-KEY} = \operatorname{SHA-512}(secret)$$ Actually, it is better to use domain separation for arriving different keys from a single secret, or input key material. This can be achieved like: $$\text{AES-KEY} = \operatorname{SHA-...


1

1) Just assume $H_1(x)$ is weak and you can generate two $x_1,x_2$ with the same hash. The other hashes then work on the same input, and hashes are deterministic, so the final output is the same. So on the first glance, it seems at best the collisions resistance is equal to the minimum of the functions. But it could also be worse. On the other hand, it ...


1

The genesis block is embedded in the chainblock (the hash of all the transactions since the bitcoin network was powered on). Now, from your question I deduce that you know little about cryptography and in particular hash functions and the blockchain protocol so I will try to explain myself in the simplest (and obviously incomplete) way possible: Blockchain ...


2

There are no known attacks on SHA3 series that are faster than the generic attacks. Your problem is the 2nd pre-image attack: given a message $m_1$ finding another message $m_2$ such that $m_1 \neq m_2$ and $Hash(m_1)=Hash(m_2)$. SHA3-256 has $2^{256}$ 2nd preimage resistance. Now, you only allow the attacker first 20-byte which is 160-bit of your data. ...


0

Sounds like you're asking about the Fawkes signature scheme, based on a series of hash commitments. (No bloom filters involved, only hashes) https://www.cl.cam.ac.uk/~rja14/Papers/fawkes.pdf The basic idea is that you start with a secret and a hash commitment of that secret. You publish only the commitment hash. You then write a message that contain the ...


1

If you use the same size input, there may no be a collision at all. It is better to increase the input size like double of $n$. Note that the input is padded so that the input to $\operatorname{SHA256}$ it is multiple of 512-bit. Keep generating two random string You need to store all the hashes to see that there is a collision. If you don't store ...


1

I do not have access to the paper you have linked, but I certanly can answer the first question and maybe answer the third question: $(\hat{u}, \hat{v}) \in G_2^2$ is a short version of $(\hat{u}, \hat{v}) \in (G_2 \times G_2)$ which is a short version of "$\hat{u} \in G_2$ and $\hat{v} \in G_2$". Since I don't have access to the paper I'm gonna make some ...


1

Generally we operate on bits and bytes, not hexadecimals. Hexadecimals are just a convenient way for humans to look at the value of the bytes. Furthermore, you seem to try and define your own KDF using HMAC. This is not likely a problem, but you do not use a well vetted scheme if you do so. Presuming that the seed is secret and random, you have 32 bytes or ...


1

Let us repeat the properties for a hash function: Given h(x) but not x, the adversary can't compute x in polynomial time but a negligible chance (preimage-resistance). Given a pair x and h(x), the adversary can't compute y such that h(y) = h(x) in polynomial time but a negligible chance (second-preimage resistance). The adversary can't compute any x and y ...


2

No, the next number in the sequence of the generator in the question cannot be safely considered unpredictable. At least one reason for that: we can infer from the example seed value "something" that the seed is not entropic enough. An adversary knowing the method, the hash, and the first 3 outputs or so could very plausibly enumerate likely seeds from a ...


1

The random variables are $k_0$ and $k_1$, typically taken to be uniformly distributed in $\mathbb Z/p\mathbb Z$ in this context. (Sometimes we take $k_0$ to be uniform in $(\mathbb Z/p\mathbb Z)^\times$ instead, i.e. exclude $k_0 = 0$, but as long as $p \gg 2^{100}$ this is not important.)


1

The simplest solution to this would be to encrypt Bob's pass phrase under Alice's pass phrase. In particular the following steps would be carried out for that: Generate a salted password hash (using e.g. Argon2 or bcrypt) from Alice's pass phrase, call it $SK$ Use $SK$ to encrypt Bob's pass phrase symmetrically, e.g. using AES-GCM If you want to be fancy ...


0

I found chapter 7 of the (still in progress) book "Graduate Course in Applied Cryptography" by Shoup and Boneh pretty useful as a thorough explanation of authentication based on universal hashing: https://crypto.stanford.edu/~dabo/cryptobook/


2

There are two orthogonal question axes here: Universal vs. strongly universal. A universal hash family has bounded collision probability: for any inputs $x \ne y$, the probability that they collide under a random hash function $H$ is bounded by $1/t$, where $t$ is the number of possible hash values: $$\Pr[H(x) = H(y)] \leq 1/t.$$ (If hash values are $m$-...


1

Welcome to Crypto Stackexchange! This is a good question. Strongly universal hash functions have the property that the probabilities of two hash values being equal is limited by the function $\frac{1}{2^{2m}}$. The $\delta$ universal hash functions, however, are limited by $\delta$, which may be any function. So, to say that a function is strongly ...


1

To calculate a pepperedPassword I can either just concatenate two values: Bcrypt limits the password. This means that if the password is too long (longer than 56 bytes), it will simply be truncated. If you just attach the pepper to the password, there is a high risk that this will happen. Then the pepper's security gain could even be lost without being ...


3

Lets get one thing out of the way: forcing one bit to 0 or 1 does not change the output size of the hash. A hash output is not a number, so the output size would not be affected. Reducing hash output is common practice. Although maybe not a direct requirement, generally the output of a hash is considered indistinguishable from random - if the input is ...


18

With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit hash, you get a $k$-bit hash function. Truncating SHA-256 to 255 bits gives you a hash that's almost as good as SHA-256: it has $2^{255}$ strength against ...


6

Apart from the slightly reduced resistances, there is no problem: Resistances for SHA3-512; Pre-image resistance decreased to $2^{511}$ or $2^{504}$, if 1 bit or 1 byte trimmed, respectively. Secondary preimage resistance decreased to o $2^{511}$ or $2^{504}$, if 1 bit or 1 byte trimmed, respectively. Collision resistance decreased to o $\sqrt{2^{511}} = \...


6

I do not know how they are related to each other. EtM, MtE and E&M are generic constructions that take pairs of schemes that satisfy weaker security notions (chosen-plaintext security and unforgeability) and turn them into AEAD-secure schemes. GCM is a construction that takes a 128-bit block cipher and turns it into - an AEAD-secure scheme and ...


2

The first Cryptography textbook implicitly containing word regular for hash functions may be in Stinson's book Cryptography Theory and Practice, First Edition, 1995, around pages 234-237. T Since we are interested in a lower bound on the collision probability, we will make the assumption that $\mathbf{h^{-1}(z) \approx m/n}$ for all $\mathbf{z \in Z}$. (...


0

Hashing small messages works identical to hashing large messages. Merkle–Damgård construction: Currently the most common hash functions are based on the Merkle–Damgård construction (i.e. MD5, SHA1 and SHA2). A message is divided into equal sized blocks and then each block goes through a one way compression function (to be exact, the next to be compressed ...


0

While hashing, the messages are divided into chunks and padded so that a message is fit into the chunks, properly. For example in SHA-256 the message appended 1, then many zeroes and finally the message size in 64-bit added. The total size must be $x$ multiple of 512 where $x$ is minimum. No, they are not separately hashed, they are chained. If not it how ...


0

This is sometimes called hash-twice in the literature. Obviously it can't do better than $n$-bit (second-)preimage resistance and $n/2$-bit collision resistance, but it can do worse. It has long been a folklore construction; it seems to have been first formally analyzed in Elena Andreeva, Charles Bouillaguet, Orr Dunkelman, and John Kelsey, ‘Herding, ...


Top 50 recent answers are included