New answers tagged

0 votes
Accepted

Adding hashes together

Now say I want to be able to prove that I know one of the 64 byte chunks of data that makes up the FinalHash This doesn't do that; as it is easy to "prove" almost any string as data that ...
poncho's user avatar
  • 146k
0 votes
Accepted

Is this an example of a sponge construction?

I don't really understand whether the long internal state of a sponge construction is compressed in the squeeze phase, or whether bits are extracted from it. In a pure sponge construction of a hash, ...
fgrieu's user avatar
  • 140k
2 votes

Can a collision resistant hash return zero?

Regarding the related question on what can be said for a general cryptographic hash function. Collision resistance does not imply that it is hard to find an input where the function returns $0^n$. For ...
Morz's user avatar
  • 33
3 votes

What is tiger192,4 in PHP?

This excerpt is directly from the official "Tiger" reference implementation: https://biham.cs.technion.ac.il/Reports/Tiger/tiger-src.zip ...
LightBulb's user avatar
0 votes

Find two hard to reverse functions f and h such that f ∘ h ∘ g = h (f and h injective, no constraints on g)

It is essentially key exchange: let $x$ be the input, $g$ encrypts $x$ using public key 1, $h$ encrypts the result using public key 2, and then $f$ decrypts the result using private key 1, where ...
xacid's user avatar
  • 74
4 votes

Is every output of a hash function possible?

Actually, it turns out that for all the SHA-3 hashes (SHA3-224, SHA3-256, SHA3-384, SHA3-512) that all hash outputs are possible. The proof relies on the following properties: That the permutation ...
poncho's user avatar
  • 146k
2 votes

Hash Output Distribution for Partly Randomised Input

In general the process of converting from "partial randomness" to "uniform randomness" is known as randomness extraction. One can show that "hashes" are good randomness ...
Mark's user avatar
  • 12.5k
2 votes
Accepted

Is the composition of a hash function with a block cipher collision resistant?

You can probably prove this to be collision-resistant if $E$ is an ideal cipher (and $H$ a random oracle). But it cannot be proven from the simple PRP (SPRP) security of $E$. A simple counterexample ...
Mikero's user avatar
  • 13.1k
0 votes

Is the composition of a hash function with a block cipher collision resistant?

Under your non-standard definition of collision resistance given below, the composition of a hash and block cipher is not collision resistant at all: Assume $H$ is a collision resistant and preimage ...
kodlu's user avatar
  • 22.1k
7 votes

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

SHA2(password) + SHA3(password) If by this you mean a concatenation of the two hashes, this actually makes it easier to break. The attacker only needs to have either SHA2 or SHA3 rainbow table ...
jpa's user avatar
  • 328
2 votes

Name for number of output values a hash function can produce?

The set for result in the definition of a function (including, a hash function) is the destination domain, e.g. $\{0,1\}^{256}$. The subset actually reached is the function's image set. The number of ...
fgrieu's user avatar
  • 140k
0 votes

Is the composition of a hash function with a block cipher collision resistant?

I imagine the following security experiment: 1) first the challenger (not the adversary) picks a key $K$ for $E$ uniformly at random from the key space of the block cipher; 2) the challenger then ...
hakoja's user avatar
  • 2,715
1 vote

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

Others have already pointed out that raw hashing is totally unsuitable for password security. But even if you're using a hash normally in an otherwise acceptable way, hashing using two different hash ...
djao's user avatar
  • 776
2 votes

Name for number of output values a hash function can produce?

I think it is just called the output size or possibly the security in bits, as the hash output size is directly tied to it. That is: we presume that the resistance towards pre-image & collision ...
Maarten Bodewes's user avatar
  • 92.4k
4 votes

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

Whenever you do something that is not standard, you risk that your implementation is broken. Either your scheme is broken on its own, or your implementation allows an attack on a scheme that would be ...
gnasher729's user avatar
  • 1,160
35 votes
Accepted

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

"nobody has a rainbow table for [this scheme]" Well, this is a huge claim so needs justification. Building a rainbow table is not hard. Once you are a target, the table will be ready. For ...
kelalaka's user avatar
  • 48.3k
7 votes

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

Is there any possible benefit? The only possible benefit I can see would be if someone picked an enormous password (one so long that there are over $2^{256}$ plausible passwords of that length). In ...
poncho's user avatar
  • 146k

Top 50 recent answers are included