New answers tagged

7

minimum reasonable length for a truncated hash (specifically, a truncated SHA256 hash) to ensure preimage resistance. To answer this one might consider the attacks. Brute-force preimage algorithm: Currently, the collective power of the BitCoin miners reached $\approx 2^{92}$ SHA-256 double hashes per year in 06 Agust 2019. If you assume that the miners ...


0

HMAC is what you need: The HMAC of the secret is provided at the start of the round The box gives out the HMAC key at the end of the round If someone guessed the word correctly in the round, then the box gives the HMAC key out to all the contestants, so everyone can verify that the box is telling the truth that a contestant was correct If no-one gets the ...


1

Context should be constant for one "keystore": that is the property of the KDF that is used for namespacing the salt space and make sure that two different application (or keystore) will not reuse the same salt. Subkey_id, however, needs to be different for each key within a given key store and it is NOT to be used for namespacing. It can be constant for a ...


6

Signature generation is not encryption with the private key. Still, the basic flow of what you describe is correct for signature generation. However, the verification step is where everything derails. As indicated in the comments, it is impossible to reverse a cryptographic hash. However, for signature verification, it is assumed that the verifying party ...


-1

Misiec´s conjecture: Let $$x= \frac{1}{n \cdot n^{\frac{1}{2} + n \cdot 2 \cdot i}}$$ if $n$ is a prime number then the $\sin(x)=x$, and if not the number is not a prime number. Even though the conjecture does not hold true the $x$ value obtained turns a non-prime number into a complex prime number.


1

As stated in other answers, yes revealing $y=\operatorname{SHA-256}(\mathrm{secret}\mathbin\|\mathrm{known\_constant})$ in addition to $x=\operatorname{SHA-256}(\mathrm{secret})$ gives extra information about $\mathrm{secret}$. That has both theoretical and practical implications. From a theoretical standpoint, that's very likely to reduce the number of ...


1

This is the pre-image attack on hash functions, i.e. pre-image attack : given a hash value $y$ find a pre-image $x$ such that $y=h(x)$. Good designed cryptographic hash functions have $\mathcal{O}(2^{n})$ classical pre-image resistance for $n$-bit output. The classical attack tries all possible input space to find a $x$ that hashes the target hash value. ...


0

scrypt scrypt is actually a password-based key derivation function (PBKDF *) created by Colin Percival; Stronger Key Derivation via Sequential Memory-Hard Functions. We want slower PBKDF functions since it will slow the attack times. The below is from hashcat performance; scrpyt 1172.8 kH/s (16.61ms) PBKDF2-HMAC-MD5 ...


2

I disregard the perfect hash requirement. In the application asking for preimage-resistance with a narrow hash, one should use a purposely-slow memory-hard hash (as used for passwords, also known as key-streching or password-based hash). This greatly reduces the number of bits needed for preimage resistance. More precisely, we want to build a hash that ...


1

where "1234" is the result of hashing "foo", and "6%!*3" is the encryption of "bar" using "foo" as encryption key (or something along those lines, I'm afraid I don't know much about encryption - what I mean is that it should be possible to use the string "foo" to decrypt "6%!*3"). So you want to encrypt the usernames, then use the username as an encryption ...


1

What your describing is the core of many password hashing algorithms like bcrypt or pbkdf2. However, these are all complicated functions which don't just iterate. They are very commonly used with salt. If you would hash a password as you described n times, a reasonable choice would be bigger then 100.000. However this is only for storing the password. If ...


9

To answer every part of this question in full details would require almost a book. Here, I’ll attempt to address all sub-questions and give a brief summary together with pointers each time. If you want me to develop some specific aspect, you can ask in the comments. Most of what I will say will not be specific to proving knowledge of a SHA-256 preimage, but ...


1

By all accounts SHA-512/160 is more secure than SHA1. The only question is it secure enough? If you are only worried about preimage or second preimage resistance the answer is yes. 160 bits should be sufficient for the forseeable future even faced against powerfull adversaries. If you need collision resistance the answer gets more complicated. There are no ...


0

It is as safe as SHA-1 was initially supposed to be. The same would be true of most other notable secure hash functions with digests truncated to 160 bits. Crucially, though, the security of the resulting algorithm is always limited to 160-bit pre-image resistance and 80-bit collision resistance. It doesn't matter how much higher SHA-512 or another hash ...


1

In a chosen-prefixes collision attack, the adversary is able to freely choose two distinct prefixes $P$ and $P'$ of arbitrary content, and is able to find suffixes $S$ and $S'$ with $H(P\mathbin\|S)=H(P'\mathbin\|S')$.Note: It is common to write chosen-prefix when that logically should be chosen-prefixes. In other types of collision attack the adversary ...


3

The BLAKE3 hash function was just announced today. Internally, it's a Merkle tree.


2

It's certainly better to move to a modern hash function without significant known weaknesses than to stick with one that is known to be broken. Furthermore using a larger state for the hashing process helps mitigate certain attacks, even if your output size is limited. In an ideal world you would make the system support longer hashes, but if the choice is ...


3

Generic collisions The generic collision attack on SHA-512 trimmed to $n=160$-bit will require $2^{80}$ complexity by the birthday paradox with a 50% success probability. The generic attack doesn't require any knowledge about the internals of the target hash function. It is about collecting hash outputs and looking collision among them by building a table ...


0

When you find a collision, it will not help you in some meaningful way. Yes, you find a collision, forged a certificate, however, the document is not going to be meaningful. In short, you have little control over the hash collision. The chosen-prefix collision the attackers look for a stronger collision where H(P, M) = H(P',M') the prefix can be arbitrary. ...


2

I'm reading the question as: Prover knows a message (thus its SHA-256 hash, and message length), and position+length of a substring (thus the substring). Verifier knows the hash, the substring and its position (thus length), and message length. Prover should demonstrate knowledge of a message with such SHA-256 hash and length and with such substring at ...


1

Is this possible using the same message? No. But the message / input for SHA-256 is defined as a bit string, which - for most implementations - means an octet string, also known as a byte array. Of course, in practice, this usually means that the function has one or more update methods that accept bytes, and a method that finalizes the input, so that the ...


1

One hexadecimal digit is of one nibble (4 bits). Two nibbles make 8 bits which are also called 1 byte. MD5 generates an output (128 bit) which is represented using a sequence of 32 hexadecimal digits, which in turn are 32*4=128 bits. 128 bits make 16 bytes (since 1 byte is 8 bits).


1

The MAC under attack is built from a hash $h$ (assumed to process a hashed message by splitting it in blocks processed only once, as most hashes do), with a key split into $K_1$ and $K_2$ of equal size. It computes the MAC of a message $x$ as $$\operatorname{MAC}_{K_1\mathbin\|K_2}(x)=h(K_1\mathbin\|x\mathbin\|K_2)$$ The attack in the paper recovers $K_1$ ...


29

a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones. We might consider other constructions which may provide some strength e.g $H(H(m) || m)$ however: b. We have no need for any such double hashing of SHA1 as we have newer ...


2

There is the idea of a fuzzy vault, a coding theory based idea first proposed by Juels, developed for biometric applications, it warrants a look. Start at Wikipedia. These notes below are excellent: https://wiki.cse.buffalo.edu/cse545/content/fuzzy-vault


Top 50 recent answers are included