Hot answers tagged

29

A common rationale for hashing twice is to guard against the length-extension property of the hash (if it has that property, as many hashes before SHA-3 did). For SHA-256, this property allows to compute $\operatorname{SHA-256}(X\|Y\|Z)$ knowing $\operatorname{SHA-256}(X)$ and the length of $X$, for some short $Y$ function only of the length of $X$, and some ...


12

Cryptography (and real security in general) offer quantitative analysis of the security provided - Meaning, real security products will describe how long they will resist a certain class of attack. With cryptography, we select our parameters such that the time required to perform the best attack would exceed the amount considered to be practical, realistic,...


9

There are close to $2^{256}$ ECC keys while there are only $2^{160}$ 20-byte hashes, so the pidgeonhole principle shows that there exist collisions. On average there there are $2^{96}$ keys for each 20-byte hash. Since SHA-256 is a strong hash function, the only way to find a collision is brute force, which involves $2^{80}$ hash computations. But ...


4

In this application we don't care about attackers generating collisions with themselves. What we care about is. Two legitimate users inadvertently generating the same address. An attacker deliberately trying to generate collisions with the addresses of existing unspent outputs. We can't reduce the risks of these to zero but we can reduce them to negligible ...


4

It is pronounced RIPE "tiny pause" M-D (RIPE for RACE Integrity Primitives Evaluation and M-D for message digest).


4

RIPEMD-160 uses precisely the same padding and endianess convention as MD5. Everything is little-endian, with the exception of the order of bits in bytes, which is kept big-endian. If the message is $n$-bit, it is appended a single bit at 1 and $511-((n+64)\bmod512)$ bit(s) at 0 , then the representation of $n$ on 64 bits. The resulting padded message is an ...


3

Theoretically, a hash function can be insecure and leak information about the plaintext. In this case knowing multiple hashes will let you make use of weaknesses in any of them. I agree with Dmitry Khovratovich that this isn't likely if you choose hash functions that are considered good, but it is a possibility. More concretely, knowing multiple hash ...


3

No, there is no security decrease in this case. While there could be some hypothetical constructions that might leak the preimage if two images are known, this is definitely not the case for existing hash functions, which are all quite different from each other. An example of such a weak pair of hash functions could be two versions of MD5: one with 63 ...


2

The use of RIPEMD-160 is not a cause for concern. It's the relatively small number of PBKDF2 iterations which is problematic. More than a decade ago, the minimum recommended number of iterations was 10,000. Nowadays, you should probably not be using less than 100,000, regardless of the hash function in use. However, even that is not ideal. If possible, you ...


2

Is there a "sane" implementation of the algorithms used by bitcoin? e.g. are there high-quality implementations available that incorporate defenses against side channel attacks? libsecp256k1 Does OpenSSL already protects against side-channel attacks? haha* How can I train myself to evaluate whether an existing implementation is vulnerable to certain ...


2

The "public address" is not a standard cryptographic notion (except perhaps in some subfield like cryptocurrency), and no context is given. That makes the most sensible way to rephrase the question: Can a public key be found from its SHA-256 or RIPEMD-160 hash? No, for any public-key cryptosystem, and absent other information (e.g. a list of ...


1

If you look at the Wikipedia on padding article page, you will see many different ideas. The main problem when designing a padding, firstly, one has to consider how to eliminate the padding correctly, all the time. It is the designer's choice, as noted in and the original RFC 4634 -- SHA and HMAC-SHA. Once you put 1 followed by many 000 to the end of a ...


1

Unlike the ciphers, the hash algorithm is not used directly to protect your data. Its only purpose is to take your ASCII passphrase and mix it up, shrinking or expanding it to the size required by the underlying ciphers. In order to make brute force attacks more infeasible, this process is repeated thousands of times in an algorithm called PBKDF2-HMAC so ...


1

I've always had a problem with probability and that is that over time it will happen 100% for sure. So even if something won't happen statistically for a millenia there is nothing to stop it happening today at say 12.01 pm and then not happening for another millenia or perhaps even happening today, tomorrow and the next day and then not happening for another ...


1

If I know your password is k bits long and I know the m bits, then I have to brute force the rest of the k-m bits. That's the standard for any algorithm and independent of whether this is prefix, suffix etc. This means that I have $2^{k-m}$ tests to make. However, you can even do better, You can say that you have a decayed version of the key, or you have ...


Only top voted, non community-wiki answers of a minimum length are eligible