133 votes

How do hashes really ensure uniqueness?

The simple answer is that hashes don't ensure uniqueness. Very broadly, hashes behave like "deterministic random numbers" – deterministic in the sense that hashing the same data always ...
David Richerby's user avatar
33 votes

How do hashes really ensure uniqueness?

Firstly, some definitions; Pre-image resistant: given a hash value $h$ find a message $m$ such that $h=Hash(m)$. Consider storing the hashes of passwords on the server. Eg. an attacker will try to ...
kelalaka's user avatar
  • 48.3k
26 votes
Accepted

Could we break MD5 entirely in the future?

If you follow the reference for the alleged preimage attack on MD5, you will see that although the time cost is $2^{123.4}$ steps, the memory cost is $2^{45} \times 11$ words of memory, which has a ...
Squeamish Ossifrage's user avatar
24 votes
Accepted

What are the consequences of removing a single byte from a sha256 hash?

Does this bias the hash in any way? We want the avalanche criteria on the output bits, that is a change in the any of input bit must randomly affect half of the output bits. Each bit of the hash ...
kelalaka's user avatar
  • 48.3k
23 votes
Accepted

What makes SHA-256 secure?

It's worth pointing out that in the case of SHA2 and most other hashes the compression function has a block cipher (keyed permutation) as its core. Basically what you are asking is identical to ...
Jacklos44773's user avatar
22 votes

What makes SHA-256 secure?

The design and security of SHA-256 rely on two cryptographic structures; one-way compression function which is based on Davies–Meyer structure which uses SHACAL-2 block cipher and on the top the ...
kelalaka's user avatar
  • 48.3k
19 votes

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

The only differences in calculations are the initial value and the output size. From NIST FIPS 180-4 The initial hash value, $H^{(0)}$, shall be set as specified in Sec. 5.3.4; and The 384-bit ...
kelalaka's user avatar
  • 48.3k
18 votes
Accepted

SHA3-255, one bit less

With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit ...
Gilles 'SO- stop being evil''s user avatar
15 votes

How do hashes really ensure uniqueness?

... its practically impossible to recreate a hash that for any foreseeable endeavor its fine or is there some element that I'm missing that reduces even that extremely low probability to zero? The ...
Maarten Bodewes's user avatar
  • 92.4k
13 votes
Accepted

Hash paradox in an image file that contain hash text?

is there a solution how to achieve my purpose? We can re-formalize your question in a general form as; Find a text that contains its hash inside of it. $$\text{digest-value} = \operatorname{Hash}(\...
kelalaka's user avatar
  • 48.3k
12 votes
Accepted

Does preimage resistance and/or collision resistance imply the infeasiblility of finding fixed points in hash functions?

No, preimage-resistance or/and collision-resistance do not imply the infeasibility of finding fixed points in hash functions. For example, define $H(x)=\begin{cases}0^{256}&\text{if }x=0^{256}\\\...
fgrieu's user avatar
  • 140k
12 votes
Accepted

How secure is SHA-1 against preimage attacks currently?

To my knowledge, the SHA-1 hash function is still believed to have 160-bits of pre-image resistance against classical computation. There have been results showing that reducing the number of rounds in ...
Daniel S's user avatar
  • 22.9k
9 votes

Hash paradox in an image file that contain hash text?

There have been at least two successful attempts to create GIF images that display their own MD5 hashes: Hashquine by spq Hashquine by Copyheart Rogdham You can download both files and verify that ...
nneonneo's user avatar
  • 191
8 votes
Accepted

Is finding collisions in a part-hash not often enough a bad problem?

There are different birthday bounds when we draw independent uniform random integers less then $d$  (for some large $d$, including $d=2^{32}$ of the question) and watch for collision(s): In ...
fgrieu's user avatar
  • 140k
8 votes
Accepted

What gives SHA-256 its preimage resistance?

You appear to be thinking "the output of the round function appears to be a simple function of the previous round, and a word from the message; why can't we select message words to steer the output to ...
poncho's user avatar
  • 146k
8 votes

How do you find the preimage of a hash?

In both mathematics and cryptography, given a function $H$ from set $A$ to set $B$, and an element $b$ in $B$, a preimage of $b$ by $H$ is any $a$ in $A$ such that $H(a)=b$. In cryptography, a public ...
fgrieu's user avatar
  • 140k
8 votes

How can I determine if a hash function is secure?

The best way to approach problems like this is to start by assuming that a simple solution exists. That assumption might be wrong, of course, but: since this is a textbook problem, it probably does ...
Ilmari Karonen's user avatar
8 votes

How is pre-image resistance defined, formally?

$\newcommand{\xs}{\xleftarrow\$}\newcommand{\mc}{\mathcal}$ There is a paper from 2004 (last revised 2009) by Rogaway and Shrimpton "Cryptographic Hash-Function Basics: Definitions, Implications and ...
SEJPM's user avatar
  • 45.9k
8 votes

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Any hash function? Yes, certainly. In fact, most hash functions are not even designed to be resistant to preimage attacks. This includes CRCs and standard checksums like Fletcher. Creating preimages ...
forest's user avatar
  • 15.2k
8 votes

Why would this algorithm be vulnerable to a preimage attack?

Firstly, remember what is the pre-image attack*; The pre-image attack is that given a hash value $h$ one need to find an $x$ such that $h = \operatorname{Hash}(x)$. The founded value doesn't need to ...
kelalaka's user avatar
  • 48.3k
7 votes
Accepted

Why do different applications of hash functions demand different properties of the hash function?

Hash + digital signature If the hash is not collision resistant, the attacker can produce two messages having the same hash. They'll request a signature on the first and present the signature on the ...
CodesInChaos's user avatar
  • 24.8k
7 votes
Accepted

Would finding a Merkle-Damgård preimage that doesn't change the initial state allow an attacker to prepend it to any hashed message?

Not quite. But it would allow computing ${\rm MD5}(M \,\|\, {\rm pad}_M \,\|\, m \,\|\, {\rm pad}_m \,\|\, {\rm whatever})$, where ${\rm pad}_M$ and ${\rm pad}_m$ are the extra length padding bytes ...
Ilmari Karonen's user avatar
7 votes
Accepted

Computational requirements for breaking SHA-256?

First of all, are my assumptions above correct? What would the complexity of the three attacks be? I am also curious what "unit" a number like $2^{256}$ implies - is it something like ...
dusk's user avatar
  • 1,175
7 votes
Accepted

Do well-known hash functions have any "impossible" output values?

No, it is not known that any cryptographic hash in common use has impossible output values (that is a bitstring of the appropriate size to be an output, but that is not reached by any input message). ...
fgrieu's user avatar
  • 140k
7 votes

"official" guidelines about the minimum length of a truncated hash

minimum reasonable length for a truncated hash (specifically, a truncated SHA256 hash) to ensure preimage resistance. To answer this one might consider the attacks. Brute-force preimage algorithm: ...
kelalaka's user avatar
  • 48.3k
7 votes
Accepted

Are My Answers to This Hash Question Correct?

What needs to be memorized in applied science (physics, crypto) is not a set of formulas. It's, for a few of the simplest formulas studied: what the formula yields, for what inputs, the units for ...
fgrieu's user avatar
  • 140k
7 votes
Accepted

Practicality of a certain hash function

The obvious weakness when one sees a square is $$(a)^{2} = (-a)^{2},$$ This is not a problem in the Rabin Cryptosystem since it requires an additional mechanism to resolve the message from possible 4 ...
kelalaka's user avatar
  • 48.3k
7 votes

SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS

What is the motivation of choosing SHAKE256_256 instead of SHA3-256 in XMSS and SPHINCS. For Sphincs+ (SLH-DSA), sometimes there is a need to generate more than 256 bits from a single hash operation; ...
poncho's user avatar
  • 146k
6 votes

Are there any successful preimage attacks?

MD4 is Not One-Way. The attack described in the 2008 paper is a theoretical attack with complexity $2^{102}$, which is better than the brute force complexity of $2^{128}$. In later theoretical results ...
Henrick Hellström's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible