Hot answers tagged

29

a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones. We might consider other constructions which may provide some strength e.g $H(H(m) || m)$ however: b. We have no need for any such double hashing of SHA1 as we have newer ...


25

For any one of the SHA hashes, the hash should be indistinguishable from pseudo-random. That means each and every bit flips with a chance of 50%. So on average half of the amount of bits gets flipped, as long as the input message doesn't repeat (because that will match 100% with the hash of the identical message, of course). It doesn't matter how many input ...


20

Does hashing algorithms have an upper bound in the input space? They can, but they don't have to and it depends on their specification. All Merkle-Damgård based hash functions do have an upper limit, because appending the message length simplifies the security proof and the backdoor-resistance of the function and they usually use a fixed-length encoding of ...


11

SHA-1 is broken in practice in terms of finding collisions. This shattered attack (identical-prefix collision attack) requires roughly $2^{63.1}$ SHA-1 evaluations and this is approximately 100,000 faster than finding collisions with generic birthday attack on 160-bit output that has $2^{80}$- time complexity. That is, for a hash function with $\ell$-bit ...


10

how many bits in the resultant hash will change, if the x bits are changed in its the original input 50% on average, regardless of how many bits are changed. SHA-1, like all cryptographic hash functions, attempts to model a pseudorandom function according to the random oracle model.* This means that any change to the input will result in, on average, 50% ...


10

No, unfortunately your well meant comparison with HMAC fails and RSA with SHA-1 - as defined for PKCS#1 v1.5 padding and PSS - is considered insecure. The construction of HMAC makes it near invulnerable to attacks on the collision resistance of the underlying hash. That is because it uses the secret key as input to the hash function to create the additional ...


8

CRCs are OK to detect naturally-occurring errors. But in cryptography, we face intelligent adversaries, which can use the mathematical properties of CRCs in order to make an arbitrary alteration in a file without altering its CRC. This is easy, even for large CRCs. Hashes are designed to prevent that (called a second-preimage attack), and other attacks such ...


8

Finding a simultaneous collision for all three would take the effort of approximately $2^{72}$ SHA-1 compression function evaluations. The overall idea would be to take the general $2^{67}$ idea found in the answer to How hard is it to generate a simultaneous MD5 and SHA1 collision? and perform the attack 33 successive times (generating 33 places in the ...


6

SHA-1, like the earlier MD5 and SHA(-0), and the later SHA-2, is built per a carefully devised hierarchical design: Merkle-Damgård at the outer, building a collision+preimage-resistant hash with a security argument based on a fixed-width compression function. Davies-Meyer to build that compression function, with a security argument based on a block cipher ...


5

We can consider Merkle-Damgard(MD) based hash functions like MD4, MD5, SHA-1, SHA-256, SHA-512, and derivatives as a rotated block cipher, where the key is the message and the input is the previous state. A bit more formally, for SHA-1, there is a block cipher, named SHACAL, that takes a 512-bit key and 160-bit block as the input. Then the MD construction ...


5

What is the need for further encoding the hash value? Representing the hash as a string of characters, without increasing the size too much. This is known as Binary-to-text encoding. It is commonly used for cryptographic data (hashes, ciphertexts..), because that can contain arbitrary sequences of bits (or arbitrary sequences of arbitrary bytes), and some ...


5

I want to perform a collision attack Actually, the problem you cited is not a collision attack, but a second preimage attack. In a collision attack, the attacker gets to select both messages; as long as they are distinct and hash to the same value, the attacker wins. In a second preimage attack, the attacker is given one message, and is asked to find ...


4

The following method is faster than poncho's answer, and it allows you to choose the CRC value. First, generate a $2^{96}$ SHA1 multicollision. Using linearity of CRCs, find a set of $\approx 2^{64}$ distinct messages in the multicollision with the target CRC value. See below for details. Simply look for an MD5 collision within this set of $\approx 2^{64}$ ...


4

So signing using RSA with a key size of 2048 with a SHA-1 hash over the content should be regarded secure just like HMAC-SHA-1, correct? The practical answer is: No, this is still insecure with all deployed RSA-based signature schemes. If you're just asking about using existing tools to make RSA-based signatures, stop here: SHA-1 is bad news, and don't ...


3

You forget one little step of how Merkle–Damgård construction works; the padding, here SHA-1 padding: append the bit $\texttt{1}$ to the message e.g. by adding $\texttt{0x80}$ if message length is a multiple of 8 bits. append $0 \leq k < 512$ bits $\texttt{0}$, such that the resulting message length in bits is congruent to $$−64 \equiv 448 \pmod{...


3

Generic collisions The generic collision attack on SHA-512 trimmed to $n=160$-bit will require $2^{80}$ complexity by the birthday paradox with a 50% success probability. The generic attack doesn't require any knowledge about the internals of the target hash function. It is about collecting hash outputs and looking collision among them by building a table ...


3

No. If it were, that would demonstrate a PRF distinguisher against the SHA-1 compression function, which would be an astonishing result showing that SHA-1 is far more broken than anyone has ever seriously anticipated.


2

It depends on how exactly the hash function is defined. Typically the first step of a hashing function is to convert the input from a series of bits or bytes to a series of blocks using a padding scheme. Many such padding schemes include the length of the input in the padding as it makes the security arguments easier. Typically the length is encoded as a ...


2

signing using rsa2048 of SHA-1 of the content should be regarded still secure No, at least because SHA-1 collisions are possible and can makes things trivially insecure. For example, using the prefix at shattered.io, it is trivial to make two PDF documents each with an arbitrarily chosen appearance when displayed and the same SHA-1 hash. Thus if Malory ...


2

It's certainly better to move to a modern hash function without significant known weaknesses than to stick with one that is known to be broken. Furthermore using a larger state for the hashing process helps mitigate certain attacks, even if your output size is limited. In an ideal world you would make the system support longer hashes, but if the choice is ...


2

Let's assume your actual input/output has entropy (which it doesn't for a given string or output hash value). If I rehash 606ec6e9bd8a8ff2ad14e5fade3f264471e82251 10x times with the same SHA1 algorithm, would the entropy keep on decreasing? Yes, but by ever so tiny amount. Hashes are designed so that every bit is dependent on all the bits of the input. ...


1

The security property needed for one-time password generation is that of a pseudorandom function. HMAC is assumed to be a pseudorandom function, when the hash function has certain properties. Collision resistance is not a required property for HMAC to be a secure pseudorandom function. However, when collision resistance is broken, this brings into question ...


1

By all accounts SHA-512/160 is more secure than SHA1. The only question is it secure enough? If you are only worried about preimage or second preimage resistance the answer is yes. 160 bits should be sufficient for the forseeable future even faced against powerfull adversaries. If you need collision resistance the answer gets more complicated. There are no ...


1

Is this the normal behaviour? No, it is not. While it is known that SHA-1 collisions can be found, it's a lot more work than what you do. It's likely to be a bug in your code. I went through your code, and I'm not sure whether you might be computing the hash of the same preimage each iteration - that would certainly cause each hash to be the same.


1

There are many possible constructions but the simplest is probably to initalize a counter with a random seed and hash the counter to produce more random bits and then increment the counter.


1

Cyclic redundancy checks are for quickly checking data integrity, mainly for detecting accidental data corruption. CRCs are not meant to be attacked, not even by your little brother, they are easily reversible, and have one application. Think of the CRC as functioning along the lines of a hand-held calculator. Cryptographic hashes can help protect national-...


1

So what's the point then, if they both detect such small errors? What CRC* can't do and SHA* and some MD* can, is that the latter are usually strong enough to prevent any supercomputer from creating 2 different files with the hash digest, where as CRC* don't have such strength. CRC* are good at detecting "wire noise" errors, but otherwise lacking certain ...


1

One hexadecimal digit is of one nibble (4 bits). Two nibbles make 8 bits which are also called 1 byte. MD5 generates an output (128 bit) which is represented using a sequence of 32 hexadecimal digits, which in turn are 32*4=128 bits. 128 bits make 16 bytes (since 1 byte is 8 bits).


1

There is a paper "SHA-1 and the Strict Avalanche Criterion." From the abstract: This work provides a working definition of the SAC, describes an experimental methodology that can be used to statistically evaluate whether a cryptographic hash meets the SAC, and uses this to investigate the degree to which compression function of the SHA-1 hash meets the ...


Only top voted, non community-wiki answers of a minimum length are eligible