9

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO checksum, Bob doesn't notice that he has downloaded fake ISO I highlighted the incorrect assumption: the checksums wouldn't match. What the length extension attack ...


4

$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))$$ is mac double-hashing enough to prevent length extension attacks? Double hashing is defined by Ferguson and Schneier in their book Practical Cryptography in Chapter 6.3.1 to countermeasure again length extension attacks (and SHA256D used in Bitcoin). The details in their book, I don'...


3

This is a complementary answer to the Model Nest's answer, and will concentrate on how to achieve the constant size for messages. We assume that the files have confidentiality, integrity, and authentication while sending/ receiving. First of all, in the security proofs like the CPA game, we assume the messages have the same length, otherwise, the advantage ...


2

In a block cipher, there is a minimum length that you have to pad to, right? A block cipher uses padding to make the plaintext a multiple of the block size. It isn't used to disguise the message length. My question is how do WhatsApp, Telegram and Signal actually do this? How effective are they are hiding the length of the message? It doesn't seem that ...


2

50- byte padding staring with 1 and rest is zero ( each \ is a byte) \x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00 8-byte size part of padding where the size is encoded ( SHA-1 has 64-bit length ...


1

The question leaves to guess what the compression function is, and how it uses rounds. That being unspecified, no, increasing the number of rounds in the last compression function is not guaranteed to prevent length-extension attack, even if the compression function is changed and rather improved by adding more rounds to it. Proof by counterexample: modify ...


1

As indicated, this is about creating a $\operatorname{MAC}_k(m) = \operatorname{H}(k \| m)$ where $k$ is the key / secret and $m$ is the message / data. Now, the ABCDEFGHIJKLMNOP part is the hashed part of this URL. Would it be correct to call that part the signature? If so, what exactly is the "data" that an attacker supposedly knows? No, "...


1

It is not about having the same hash value. It was about forging a message. It was first executed on Flicker API where the signature was; $$tag = \operatorname{MD5}(\text{secret_key}\mathbin\|\text{known_data}),$$ the $tag$ and $\text{known_data}$ send to server, and the server can verify it with the $\text{secret_key}$. The attacker can extend this message ...


1

No. Length extension attacks are not attacks against hashes as hashes. They're attacks against hashes when used for purposes that require stronger security properties. A length extension calculation on a Merkle-Damgård hash allows an someone to calculate $H(A||S)$ for a specific non-empty suffix $S$ given the knowledge of only $\mathsf{length}(A)$ and $H(A)$ ...


1

Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$? Yes, given two restrictions: $MAC_k$ is not truncated (e.g. if it is based on AES, then the tag is 128 bits long). This observation does not apply on a collision on (for example) truncated 64 bit tags (assuming that the ...


Only top voted, non community-wiki answers of a minimum length are eligible