New answers tagged

4

Will it be impossible to create ASIC for such algorithm? No, actually it is quite easy. The way you'd design a single brute-force core then is that you take a hashing engine for each hash function used, an input generator, a hash validator and a smart interconnect. Then when you want to brute-force an invocation of ordering 1, the input generator outputs ...


4

The answer given by @kelalaka is 100% correct; this breaks the security of encryption and so shouldn't be used. However, I want to add that this doesn't even guarantee integrity. In particular, integrity should hold even if the attacker knows the message. Assume that the attacker knows $m$ and wishes to change the first bit. This change can be easily made (...


5

The point (( also see this answer)) is that the hash calculation is free for everybody and we assume that your methodology is known by Kerckhoffs's principles. Anybody can calculate the hash of any information and this may leak the encrypted message. In Cryptography, we consider the attackers computationally bounded, but not restricted to adapt any method on ...


2

TLDR: No. As far as I know, MD5 collisions with messages of differing length have not been found. Finding such collision would certainly be feasible by brute force, and perhaps by adaptation of existing attacks. When we take a random function with 128-bit outputs, hash $2^{64}$ inputs of one length, and $2^{64}$ inputs of another length, we expect a ...


0

Let $O$ be an oracle that provides pre-images for $G$ that is given $y$ it produces a pre-image $z$ such that $G(z) = y$. Now expand this to $$y = H(z)||LSB(z).$$ Therefore, given the oracle $O$ one can find the pre-images of $H$ by asking $x||0$ and $x||1$ to the oracle and test the result. As a result, if $G$ is not pre-image resistant then $H$ is not. too....


0

Your idea of salting the signature to prevent the collision attack doesn't work, because your salted signing operation is a deterministic mathematical function, and the random choice of salt is only made at signature time, not at verification. Your signature algorithm has to be something like this. For a document $x$ and hash function $H$: Hash the document:...


2

Suffix salt If you add the salt after the message, $\operatorname{MD5}(m \mathbin\| salt)$, that doesn't prevent Alice from finding two collisions. Example; Consider that if the message $m$ of Alice is an exact multiple of the block size of the $\operatorname{MD5}(m \mathbin\| salt)$ then your signature will be vulnerable to hash chosen-prefix collisions. ...


0

Let's begin with what is MD5; MD5 has a 128-bit digest size, 512-bit block size Merkle–Damgård construction based hash function created by Ronald Rivest in 1992. From a secure hash function we want, 128-bit pre-image and secondary pre-image resistance, and 64-bit collision resistance. MD5 collision resistance is broken, and finding collision can be done in ...


0

From the practical point of view both approaches have similar resistance to brute-forcing. From the implementation point of view it may be simpler to apply hash only once, without hashing of every single part. Nevertheless I would suggest you to review your design and consider other options. Suppose somebody has received your message and validation shows, ...


11

$2^{64-1}$ bits that make 2.30584301 exabytes *. If you are not restricted to SHA256, then use SHA512 that allows files to have size at most $2^{128}-1$, or use SHA3 that has no limit. The NIST must use a limit due to the artifact of the MD construction. SHA256 is standardized in 2001 along with SHA512. They have internal block size 512 and 1024 respectively,...


6

The size is just restricted by a length encoding at the end of the last block that is hashed using SHA-256 - one of the two main hash functions that make up the SHA-2 family. If you extend that size then you'd have your secure hash function with extended input. However, there is an easier way. The SHA-512 hash function - the other main hash function in the ...


1

Given an infinite number of repetitions of the above, is it possible that all possible hashes will be computed an infinite number of times? Yes, it is possible; however it is (to the best of our knowledge) extremely unlikely. Not only would MD5 (on 16 byte inputs) be a permutation, it would also need to be a single cycle permutation. Is it possible that ...


3

No, but yes, but you're asking the wrong question. A hash function, formally speaking, is a function from some input set to a finite set. There is no general requirement that the input set have a particular size or form. The input is not necessarily the set of all bit-strings. It's very common to define hash functions on structured data, for example. However,...


2

There is no requirement that a hash function 'use' any or all of the bits of the value being hashed. Admittedly, a hash function that always returns 5 is not particularly useful, but it does map an input to a value. More useful hash functions will involve more of the input value but not necessarily all of it. Thus, it is sort of meaningless to ask if hash ...


2

The MD construction uses a compression function $C$ ($F$ in the figures) such that it has two inputs. $$h_i = C(h_{i-1},m_i)$$ and the first $h_{-1} = IV$ and the last $H = h_{2^k-1}$ is the hash value. The compression function can use a block cipher, where the message to the block cipher is the previous hash value and the key is the message. $h_i = E_{m}(...


2

According to academic recordings Gene Tsudik's article in 1992; Message Authentication with One-Way Hash Functions is the first academic paper that this construction $(k,m) \mapsto \mathcal{C}(k,m)=\mathcal{H}(m\mathbin\|k)$ is defined and a name is given as secret suffix technique. The reference of invertors are not given in the article. Tsudik also ...


13

Is it necessary for a hash function to allow arbitrary length inputs or not? Although one can design a hash function that can hash arbitrary size there is no need since one can not easily pass the $2^{64}-1$ limit for SHA-1, SHA-224, and SHA-256 series, and $2^{128}-1$ limit for the SHA-384, SHA-512, SHA-512/224 and SHA-512/256 series. During the ...


18

Is it necessary for a hash function to allow arbitrary length inputs or not? Of course not. SHA-256 is limited to inputs of 18,446,744,073,709,551,615 bits or less; it is not defined for larger inputs; SHA-256 is not disqualified from being considered a hash function because of this limitation.


2

I am wondering if I can remove/reduce any field to save space, is there a way to save overhead in ESP packages? Well, there was an old IETF draft here to address this very problem; however it didn't get enough traction in the IPsecME working group (for the complexity it has, it doesn't save that much space) and thus was abandoned. Sticking to standard IPsec,...


3

In the first part of this answer, I restrict to reading requirement 2 as "if one pair $(m,r)$ is known…", and assume that $k$ is chosen at random. I entirely disregard security when an adversary knows two distinct pairs $(m,r)$, or when related keys $k$ are used. The following construction uses the Galois Field $(\mathbb F_{2^{64}},\oplus,\otimes)$,...


5

The typical reason one uses double hashing is to deal with length-extension attacks. That's because any Merkle-Dåmgard algorithm that outputs its entire state (e.g., SHA-1, SHA-256, and SHA-512) is vulnerable to a length extension attack, where users who know a hash can append additional data and also produce a valid hash. There are other algorithms, such ...


13

Since the initial release of Bitcoin is 9 January 2009, the designer had these NIST hash functions (NIST-FIPS 180-4) as available options: SHA-1( 1995), SHA-256 (2001), SHA-512 (2001), and some more. The main difference between SHA-256 and SHA-512 is the target CPU. SHA-256 is designed for 32-bit CPUs and SHA-512 is designed for 64-bit CPUs. That makes a ...


7

Comparing double sha256 to sha512 is like comparing apples to oranges. For one, the result of sha512 is 512 bits in length. The result of double sha256 (or triple sha256, or quadruple sha256, for that matter) is 256 bits in length. There has been a lot of conjecture over the years as to why the creator of bitcoin chose to use double sha256 in the protocol. ...


1

No, they can only tamper the pre-image if they previously inserted a known week message. It is possible to pre-calculate two (or more) messages so that they have the same hash, i.e. a collision. It is also possible to simply use two known files with the same SHA-1, such as the PDF documents from the SHAttered attack. Then they could execute specific actions ...


2

The problem with SHA-1 is the collision attack that way before the actual attack shattered.io NIST dropped it in 2011 from digital signatures since finding collision has catastrophic result in Digital Signatures. The generic collision of SHA-1 requires $2^{80}$-time and that was considered low for 2011 and beyond. The Rabin was the one first to use the hash (...


1

The sagemath with symbolic computations doesn't provide the same results. Contact the authors. n = var('n'); a = 0.442 b = 0.0001 c = 0.0018 d = 0.0138 (2*n+2)*a + (2*n)*b + (2*n+2)*c + (2*n)*d output 0.915400000000000*n + 0.887600000000000 $$(2*n+2)*a + (2*n)*b + (2*n+2)*c + (2*n)*d = $$ $$ 2n(a+b+c+d) + 2(a +c) $$ $$ 2n ( 0.442 + 0.0001 + 0.0018 + 0.0138)...


0

Let's suppose our algorithm is irreversible. Can we - in that case - guarantee that states will not narrow down into some subdomain? Can we prove the security level provided by digest size or capacity? We cannot span the space of digest-message pairs when using irreversible functions. The only way of the proving the security level is using reversible sub-...


3

Short answer As Maeher said, the adversary cannot recognize which points are reprogrammed or distinguish $\widetilde E$ from $E$, given oracle access to $\widetilde E$ (or $E$). This is because the adversary who detects such points can also be used to break the PRP security of $E$ by finding the key $K$. Formal proof It suffices to prove that no efficient ...


0

Proving that a secure cipher can exist is an open problem (aside from one-time pads, mentioned in other answers, which are not very practical). But it isn't reasonable to predict that what happened to MD5 and DES will happen to AES. MD5 was expected to have a limited lifespan. It's been known from the beginning that collisions could be found with roughly 264 ...


1

We do not know if there are one way functions. This is related to the P=?NP question you may have heard of. If P=NP we can not have cryptography as we know it as if you can decode something with a key in Polynomial time you will also be able you to decode it without the key in polynomial time provided you can verify correct results. It is also possible that ...


4

Some of us believe that it is possible to create ciphers and hash algorithms that are unbreakable (like when people said that we'd never run into an MD5 collision in the lifetime of the universe), but get broken in a couple of decades time (MD5 collision can be created on a modern PC in minutes). MD5 or any other hash function is not proven to be secure. ...


1

Yes, you mean encryption methods with perfect secrecy Perfect Secrecy (or information-theoretic security) means that the ciphertext conveys no information about the content of the plaintext. In effect, this means that, no matter how many ciphertexts you have, it does not convey anything about what the plaintext and key were. It can be proved that any such ...


1

Back to 1949, Claude Shannon in Communication Theory of Secrecy Systems proved that perfect security (cipher that is perfectly secure and unbreakable) can be obtained only in information-theoretic model with the One Time Pad and only when the amount/size of your key is longer or equal to the amount/size of your plaintext, so impractical, and so welcome to ...


0

That is possible if ... SHA-256 is not broken today, but it is not a provable collision resistance hash function and it will be broken in the future. If you know the collisions or preimages for SHA-256, you can change some parts of this hash function and design a new modified hash function that its output is similar/correlated to SHA-256. In Malicious ...


1

To backdoor short messages or e.g. their prefixes, you can choose some deterministic public key encryption scheme $PK$ with short ciphertexts (not sure if there are ones suitable here), generate key pair $(Pub,Priv)$ and define hash as $$H(m) = FirstBits_{128}(SHA256(m)) ~||~ Pub.Encrypt(FirstBits_t(m)).$$ $H$ will be "similar" to SHA256 in that ...


1

I was thinking of creating a hash function that produces a similar/correlated output to SHA256, but with an in-built "backdoor" that allows for preimage attacks. Sort of creating a "breakable" version of SHA-256. That is not possible for arbitrary sized messages and unkeyed hash functions. Assume that you created a hash function such ...


6

4.4 Merkle–Damgård construction requires a one-way compression function and the common way is to use a block cipher. If you initiate with the simple way; $$d^i = f_{MD4}(d^{i−1}, m^i)$$ then the message is the key. Now, consider that we want to find a collision. Take an arbitrary $h$ as the output of the hash function, take two arbitrary but different ...


3

What does hermetic mean in this context? As per section 3.5.5 of the paper (which goes into further detail): Definition 3.4 A cryptographic scheme is hermetic with respect to some application if it does not have weaknesses that are exploitable in that application and are not present for the majority of corresponding super cryptographic schemes. Definition ...


1

DannyNiu's provide the article, and this is going to provide the details; This work has a serious result on the security of the iterated hash functions (MD- construction). From $n$-bit hash function we want $2^{n/2}$ collision resistance and $2^n$ preimage and secondary preimages resistances. They showed that Damgard-Merkle construction cannot satisfy this ...


4

The reference for the claim is here, titled "Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work" by J. Kelsey, B. Schneier. The attack is specific to un-truncated Merkle-Damgaard hash functions. I haven't understood the mechanism of the attack, but as far as I understood, it require some unrealistically large working memory ...


Top 50 recent answers are included