New answers tagged

0

Will it let you in? I suspect yes. As a software developer, I'm quite sure this has never happened, so the situation is untested, so it's not known. (As a software developer, you could modify the hash function so that it hashes anything containing the string "smith" to the number 0 and see what happens. ) But it's not going to happen. Say there are ...


0

In simple terms, a password hashing algorithm $pH$ takes a salt $salt$ and entered password $pwd$ and calculates $h' = pH(salt,pwd)$ and check $h$ with the current stored password's hash $h$, $h \overset{?}{=} h'$. will entering incorrect password that just hashes to the same let me in? If you enter an arbitrary password, it may have a negligible change to ...


1

Yes, it would, but (for any halfway decent Password Hashing Function) it's practically impossible to find such a collision. Password Hashing Functions are Cryptographic Hash Functions with some extra properties. Cryptographic hashing functions have a single input, and are collision, preimage, and second-preimage resistant. Collision resistance means that it'...


1

To: ["The",""] First International Bank ["Panama",""] Subject: ["Money",""] ["Wire","Transfer"] ["Order",""] from my account ["Num","#"]1234[".",""] I ["hear by","would like to"] Instruct ["you &...


0

If I take any message, I can append a space character or tab character to get two different messages. Each of those two, I can append another space or tab to get four possible messages. A third character gives 8 possible messages, then 16 and so on. If I take "send 10,000" and append 64 characters, and each of them is either a space or tab ...


1

Given a hash function $H()$ and a hash value $h$ that is in the codomain/range of outputs of $H()$, can you determine if $h$ can be produced by $H()$ (i.e. is $h$ in the image of $H()$)? I'll assume "codomain/range of outputs" is defined without reference to what the hash actually outputs (rather than as the set of actual outputs of the hash, ...


2

Given a hash function H() and a hash value h that is in the codomain/range of outputs of $H()$, can you determine if $h$ can be produced by $H()$ (i.e. is $h$ in the image of $H()$)? Generally, you cannot if you consider $H$ to be a black box. I would be surprised if there are values that cannot be reached by a hash function like SHA-2/3 though, because of ...


2

The quoted text seems to talk about finding a collision of a 128-bit hash function with the Birthday attack. In a birthday attack, one creates around $\sqrt{2^{128}} = 2^{64}$ messages so that they expect to find a colliding pair with 1/2 probability. In the described attack, Oscar wants to create two specific messages that have the same hash value. $x_1$= ...


6

Consider $H$ defined as: SHA-512, with it's output XORed with the first 512 bits of the input message (padded with zeroes for short message). With such $H$, the proposed MAC is insecure. Yet, as far as we know, this $H$ is no worse than SHA-512 from a standard standpoint. Argument: observe that if $H(m_1\mathbin\|m_2)=\operatorname{SHA-512}(m_1\mathbin\|m_2)\...


1

Providing a hash value is no evidence that you have a pre-image. I can easily produce the 256-bit number 0x9A867C4957D32E09420239682A3502F6, but that doesn't prove that I have an input to SHA256 that generates it. A NIZK construction would allow me to demonstrate that I do have an input that produces that value, but without revealing any information about ...


0

Even if the collision is completely unstructured and arose from two completely independent evaluations, it would still be a significant concern for a modern hash function. In cryptographic constructions, we regularly assume that the output of a hash function is distributed uniformly at random. For hash functions such as SHA256 there is no proof for this, and ...


0

H would be unsecure iff when given x1 it would be possible to algorithmically derive a different x2 with the same hash. As the the hash space is much smaller than the data space there will always be potential collisions, the question is can we find them.


4

I prefer to think of cryptography as infrastructure. We should strive to develop infrastructure that minimizes the number of usage caveats. It's not cryptography's job to define what are "meaningful" messages in your application. Can you look at a specific collision $m_1, m_2$ and say with certainty that no application of a hash function will ever ...


0

I just wanted to add a confusing, and weird phenomena, where laypeople,(e.g. journalists), very often conflate encryption and hashing. It often happens when data leaks are reported and the news article says something like "encrypted passwords were leaked". What they mean 99% of the time is that "hashed passwords were leaked". Here's a ...


2

The OP got the idea from a YouTube post that argues around the MD5. Here is the simple argument if anyone watches the video. The speed doesn't imply that a hash function is insecure, the design makes it secure. Over the years, the researcher find weaknesses in the design of the MD5 and improved over time. Once the MD5 was released, 1992, the attacks set out, ...


0

If we have at least 3 encrypted points, and the ability to calculate distances we learn the locations up to an unknown rotation and translation(Maybe randomly mirror as well) So though just applying secret translation and rotation still reveals a lot of information I don't think you can do better. As anything preserving distances will reveal the same with ...


2

Privacy-preserving distance computation on coordinates is certainly possible, with some restrictions. The paper "Homomorphic Proximity Computation in Geosocial Networks" (2016) by Hu et. al. (PDF) is a quite accessible example of doing this. The main approach they demonstrate is based on an asymmetric Somewhat Homomorphic Encryption (SWHE) scheme ...


1

Sounds a bit like coursework. (: Some ideas to get you started: Are you aware of how a ciphertext $C = (c_1, c_2)$ is constructed? That is, can you state $c_1$ and $c_2$ in terms of the message $m$, and the key pair $x, y$? Can you then state what form a ciphertext would have to have, in order to be a valid encryption of $m \cdot m'$? Once done, can you ...


0

Let's consider the use of a hash to protect a password, and take a couple of examples. First case: we have a hash function which takes 1 second to execute on a run-of-the-mill computer. If the attacker has access to 1 million computers (e.g. via a botnet), they can do 1 million attempts per second, 86 billion attempts per day. But an 8-character password ...


2

Is it feasible to build a whole branch of cryptography on a family of pseudo-random sources? In theory, yes. If there was an efficient and Cryptographically Secure Pseudo Random Number Generator built from a chaotic system, then that could serve as the foundation of reasonably practical symmetric cryptography, and even signature. Problem is we know no such ...


-2

What can chaos provide to cryptography? It can provide good entropy. And with entropy, we have truly random numbers. Useful in cryptography. There is a mathematical concept called deterministic chaos. That's a blend of chaos that is a 'bit' predictable. The classic examples are Strange Attractors like:- You can see that it is both predictable in that the ...


1

Apparently chaotic behavior is necessary but insufficient for cryptography. It's a result of cryptographic security, not a cause. Some people invert causation, and think that anything displaying chaotic behavior is suitable for cryptography. I don't know why some people make this mistake, and it's not unique to cryptography. Lorenz's definition of chaos: &...


2

I am wondering why some people think it is suitable for many cryptographical primitives Well, I'm not one of those 'some people', however I will give you my perspective. One of the good properties we like in our cryptosystems in 'avalanche'; that is, a small change somewhere ripples throughout the system. I expect that 'some people' take notice of this and ...


3

Given a hash function that is tuneable for "speed", (iterations, perhaps), increasing the speed at which it hashes does not create more collisions. The security issue with a hash that is too fast is that given X amount of time, a hash that is faster will generate a greater quantity of outputs, so an attacker has a higher chance of finding a ...


9

The currently accepted answer is good, but I'd like to add something. "security" is a broad term in this context, and you should ask what threat you want to defend against. In most discussions "collision" is all about finding a different input with an identical output. But for the password case, the "fast hash" is problematic ...


21

In most applications, it's desirable that a hash function is fast, and it would not be a problem if it was ultra fast (say, as fast as input in cache memory can reach a CPU) if that's not at the expense of security. This includes usage in signature, encryption padding, construction of block ciphers. In application doing key stretching, including access ...


5

This application reveals that some expressions in the algorithm can be reversed" Actually, it is known that a large majority of the code in SHA-2, SHA-3 can be reversed. The SHA-2 hash compression function $h(s,m) = s + f_m(s)$, where $f_m(s)$ is invertible for a fixed message block $m$ [1][2] - that is, if you know what $m$ is and what you want the ...


0

It's a question of the meaning of size $2n$ if size is number of possible values, than indeed each test has probability $1/2$ to find a collision. If the size is bit length than each test has probability $1-1/{2^n}$ of finding a collision as you wrote. Also note these calculations are lower bounds for collision finding probability. Some functions may collide ...


2

No. The birthday paradox applies to all image spaces. Randomly evaluating any function with large input space and an image space of size $2^{n/2}$ is expected to produce a collision after roughly $2^{n/4}$ evaluations.


4

Does Grover's algorithm (or any other applicable quantum algorithm) only apply to weakening the hash function itself or can it also search only plausible inputs (a-z, A-Z, 0-9 <=14 characters) to reduce the search space? Grover's is a general search method - it doesn't know or care how the function is given interprets the input. If you give it a ...


0

I think you lack of understanding how hash functions work. I advise some intro books as a start. The avalanche strict criterio makes sure that even if one bit is changes at any representation it is practically infeasible to find collissions. Your setup is definitely non secure against replay attacks. You shall follow some randomisation or salt techniques


3

This is already answered here for 1 iteration, and here for many iterations, but since the latter answer presents an heuristic argument I'll leave here Lemma 4 of Functional Graphs and Their Applications in Generic Attacks on Iterated Hash Constructions which gives a good approximation based on Theorem 2 of Random Mapping Statistics, and (3.10) of On the ...


8

No, the proposed construction is not secure, unless the block size $b$ of the block cipher is unusually large, or much wider than the MAC. Assuming $p$ known distinct message/MAC pairs $(m_i,h_i)$ with $b$-bit message $m_i$ and $h_i$ at least $b$-bit, there's a simple attack of expected cost dominated by $2^b/p$ hashes and searches among the $h_i$. The ...


2

given an algorithm of a hash function, how to transform it into a circuit? Most importantly we first want to better state the problem What hash function? Do we want a circuit for the full hash function and a fixed-length input [which seem best matches the question], or for some part of the hash [like a round of the hash function with input one padded ...


Top 50 recent answers are included