# Tag Info

2

You simply create a hashed counter. So output = SHA-256(n) whilst incrementing n. You'd make n a large multi-byte variable, say 16 bytes, and seed it at a random value from some PRNG you find lying around. That way you can perform repeat runs to generate different sequences. I find that you need >10MB for some of the template tests to complete fully. I won'...

0

As you are looking for a generic attack, I assume we model the hash function as a Random Oracle. Assume the length of the message m is n, thus the expected number of 1's is n/2 and we have 2^(n/2) options for m', each of which are equally likely to match h=H(m). Let d be the number of bits in h, and d0 the number of 0 bits, thus the probability for a random ...

2

Let the hash length be $d$. If we consider finite groups, like addition modulo $2^d,$ this problem is well understood. Fix $k=n+m.$ If the vectors are randomly generated and form a list of size roughly at least $2^{d/k},$ there exists a solution with constant probability bounded away from zero. This is because a list of size $M$ contains $$F:=\binom{M}{k}$$ ...

1

The expected number of 3-cycles in a random function on a large domain is $1/3$. More generally, for a random function on a set of size $n$, the expected number of cycles of length $\ell$ is asymptotically equivalent to $1/\ell$ as $n \to \infty$. This result, along with a general approach to the combinatorical properties of random functions, can be found ...

0

My understanding is that a BIP39 seed is created by applying a PBKDF2 function where the 24 word mnemonic is the password (in UTF8 format), the salt is the string "mnemonic" again in UTF8, iteration count is 2048, 512 bit key and hash is SHA512. Using the random example of "nation west blush exhibit elbow knee bubble strong imitate romance frown enter ...

0

I want argue heuristically that many such $3-$cycles are unlikely. Consider a random function $f$ mapping $X:=\{1,\ldots,n\}$ to itself. @MeirMaor showed that at least one such cycle has significant probability. Consider two iterations of $f$ and note that the image set $Y=f(f(X)):=h(x)$ will typically have size roughly $$(1-e^{-1})^2\cdot n:=c^{-1} \cdot ... 4 We like to think of hash functions as random functions, and there is no reason a random function shouldn't have a cycle of size 3 which is what you describe. Obviously it would be very difficult to find such a cycle, we can discuss how likely is it a random function over space size n has a cycle of size 3. Ignoring cycles of size 1 and 2 which acount for ... 2 The use of RIPEMD-160 is not a cause for concern. It's the relatively small number of PBKDF2 iterations which is problematic. More than a decade ago, the minimum recommended number of iterations was 10,000. Nowadays, you should probably not be using less than 100,000, regardless of the hash function in use. However, even that is not ideal. If possible, you ... 2 A. Find two identical messages with different hashes This is fundamentally impossible, assuming you're talking about a regular hash and not a keyed hash (like HMAC). As hashes are deterministic, two identical messages will always result in an identical hash. B. Find two identical messages with the same hash This is not only possible, but guaranteed. Two ... 12 If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary threat. The number of passes just increases resistance to time-memory tradeoff attacks (TMTO). What you are probably remembering is that Argon2i is more ... 1 Hash3( Hash2( Hash1( text ))) The collision resistance of H'(x):=H_3(H_2(H_1(x))) is most likely \operatorname{CR}(H')=\min(\operatorname{CR}(H_3),\operatorname{CR}(H_2),\operatorname{CR}(H_1)), that is the combined scheme is at most as collision resistant as any individual scheme. Of course it has to be admitted that for most choices of the three hash ... 3 Yes. If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment. If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So ... 1 You are looking for a Verifiable Delay Function (VDF). Roughly VDFs are functions which are hard to parallelize but easy to verify (for some sense of easy). One simple example is to just iterate a hash function, although this has linear verification time while more advanced functions may have sublinear verification complexity. Here is an overview of VDFs ... 8 2^m requirement is for the pre-image attack. You have to hash approximately 2^m messages to find the message that has the same value you were looking for if the hash function has pre-image resistance. In a collision attack, you are looking for two messages that have the same hash value. If you look at Wikipedia Birthday Paradox at section Cast as a ... 2 Yes, you can use a hash to "hide" messages like that. However, I don't see any advantage of this compared to normal symmetric encryption, which already is able to return a well randomized ciphertext. Randomization in itself is not steganography as I've understood it. A fully randomized message may stand out, both on its own and when simply copied into a ... -1 If you have enough computing power to crack a hash, you can send big files over the internet almost instantly, reducing the need for expensive and powerful network infrastructure, you would have to crack it faster than it takes to download the file to be worth it at least time wise, it may be physically, economically and technologically inefficient or even ... 4 The second construction is trivially not hiding. It is easy to verify a guess m' just by recomputing H(m') and comparing the result with the commitment. The first construction is a bit trickier. If it is a CPA secure encryption scheme, then it is certainly hiding. However it may not be binding. It is easy to construct secure encryption schemes, where ... 3 There are encrypted QR codes from DENSO ADC. I know that these can be encrypted or just signed; however, DENSO ADC has never been forthcoming with how they work. They seem to work by putting data after the "data section" of the QR code that would otherwise be ignored. If you were going to have something similar, I would take that approach. 0 What you describe is called proxy mining, and it exists. You basically start your "own" pool, and let your master divide the work. It's mostly done to have less load on the pool though, it has no computational advantage over having all slaves join the pool. 3 You should think of the attack as being directed against the hash function as a whole. What you are calling$$\mathrm{hash}(\mbox{message} + \mbox{length})$$is really$$\mathrm{Hash}(\mbox{message}) where I've used the capitalization to distinguish the two. $\mathrm{Hash}$, not $\mathrm{hash}$, is the actual "hash function", and this is what is ...

18

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to be more precise, they know hash(message || padding || length). Let full_hash be the proper hash with padding and length, i.e. full_hash(message) = hash(message || padding || length). You're correct that if the attacker knows hash(...

Top 50 recent answers are included