Hot answers tagged

140

[Update, 2019-09-12: Upon being exposed, and/or after taking advantage of market manipulation by their fraudulent announcements, the scam artists of Treadwell Stanton DuPont have retracted their claim, with more meaningless waffling technobabble about ‘laboratory equipment flaws’ and ‘ambiguous results’—yet they are still selling the same snake oil! I leave ...


33

This is firmly in "put up or shut up" territory. It's easy to prove this claim. I will provide them with a string and its hash. They must provide a collision. They could also mine bitcoin and earn a large bounty without actually doing harm to the block chain. They could mine faster with less energy than the competition. This wouldn't hurt anyone and would ...


21

As of today (12th September 2019) Tradwell Stanton DuPont have retracted their claim: Sorry for the image link, but the text on their site doesn't seem to be permalinkable, and I wanted a more permanent source, it says: NEW YORK, NEW YORK, UNITED STATES, September 12, 2019 The Wall Street fintech Treadwell Stanton DuPont again broke silence today as ...


19

It's worth pointing out that in the case of SHA2 and most other hashes the compression function has a block cipher (keyed permutation) as its core. Basically what you are asking is identical to asking how can block ciphers be resistant to known-plaintext attacks and chosen-plaintext attacks (arguably doesn't apply to SHA2 specifically because an attacker ...


16

The design and security of SHA-256 rely on two cryptographic structures; one-way compression function which is based on Davies–Meyer structure which uses SHACAL-2 block cipher and on the top the Merkle–Damgård structure that uses the Davies–Meyer structure. A little deeper; Compression function: transforms $2n$-bit input into $n$-bit. The transformation ...


12

This is due to the Brassard et al.'s method on hash functions. That has $\mathcal{O}(\sqrt[3]{n})$ attack time for n-bit hash function where as the Grover's method has $\mathcal{O}(\sqrt{n})$-time. Level I: At least as hard to break as AES-128 $\mathcal{O}(\sqrt{2^{128}}) = \mathcal{O}(2^{64})$ - by Grover Level II: At least as hard to break as SHA-256 $\...


11

The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are: Resistance to length extension attacks. With SHA-256, given $H(m)$ but not $m$, it is easy to find $H(m \mathbin\| m')$ for certain suffixes $m'$. Not so with any of the SHA-3 functions. This means, e.g., that $m \...


9

It is in SHA-256 message schedule (NIST-FIPS 180-4); The message $M$ with length $l$ is first padded as the usual way; append 1 to the end of the message, then, add $k$ zero bits such that $$l+1+k \equiv 448 \mod 512$$ finally, add the length of the message in 64-bit. Now, the total padded length is divisible by 512. After padding, the padded message ...


8

CRCs are OK to detect naturally-occurring errors. But in cryptography, we face intelligent adversaries, which can use the mathematical properties of CRCs in order to make an arbitrary alteration in a file without altering its CRC. This is easy, even for large CRCs. Hashes are designed to prevent that (called a second-preimage attack), and other attacks such ...


7

Difference between SHA256 and SHA3 The main difference of SHA256 and SHA3 are their internal algorithm design. SHA2 (and SHA1) are built using the Merkle–Damgård structure. SHA3 on the other hand is built using a Sponge function and belongs to the Keccak-family. The name might be misleading to think that SHA3 in comparison to SHA2 is just a "newer" ...


7

fgrieu gives a compelling visual illustration, but we can quantify this too. From Harris 1960 (paywall-free), for a uniform random function $H$ on $\ell$ elements, the number of $q$ elements that lie on a cycle is distributed by $$p(q) = \frac{(\ell - 1)! \, q}{(\ell - q)! \, \ell^q},$$ whose expectation grows with $\frac 1 2 \sqrt{2 \pi \ell}$. If we ...


7

Hash functions we use, e.g. Sha-1, Sha-256, Sha-512, usually don’t have a sufficiently large range. But we can construct full domain hash via repeated application of a hash function $h$: $FDH(m) = h(m||0)||h(m||1)||\cdots $, then take the leading n-bit. This way the hash value is deterministic and the size is arbitrary. This is something like MGF1 defined ...


7

If this provided any insight, we would consider SHA-256 to be broken. In general, we expect the $n$-bit truncation of SHA-256 to resemble an $n$-bit uniform random function. For example, finding a 10-bit partial preimage costs an expected ${\approx}2^{10}$ trials; finding a 10-bit partial collision costs an expected ${\approx}2^5$ trials. That said, there ...


6

Hash functions are deterministic, same input same output. Without a modification, you cannot change the result. The hash of a file is used at least for the integrity check. If you were able to change it without modification the integrity check will have problems. Note: as mentioned by Ella Rose in the comments if a keyed-hash message authentication code ...


5

No, you can’t. There are (at most) $2^{256}$ different possible SHA-256 hashes. If it were possible to deduce a SHA-512 hash from a SHA-256 hash with no knowledge of the data, then there would be at most as many different SHA-512 hashes as different SHA-256 hashes. Then, a SHA-512 hash would be at most as strong as a 256-bit hash.


4

For a signing scheme involving generating a 256-bit digest using SHA-256 followed by RSA with 2048-bit modulus, the signature would always be 256-bit without padding.. That assertion is wrong. For every RSA signature scheme, the signature is always at least as wide as the modulus (or next to that; there are tricks to reduce it by a few bits). Much shorter ...


4

Why don't you use an eXtendible Output Function (XOF) for that ? For example, SHAKE-128, defined in the SHA-3 standard, allows you to hash a message and obtain as output as many bits as you want. This is flexible so that it can be easily adapted to the size of your RSA modulus.


4

Cryptographic Hash functions are deterministic random functions. Deterministic means same input same output and random in a sense means that the output is unpredictable. We expect that the hash functions have avalanche effect that whenever one bit complemented from the input, each of the output bits changes with 50% probability. If it is possible to find a ...


4

The SHA-256 compression function takes a 256-bit chaining value $h$ and a 512-bit message block $m$ and returns a 256-bit chaining value $f(h, m)$. The SHA-256 hash function takes a padded message $m$ broken into an integral number of 512-bit message blocks $m = m_1 \mathbin\| m_2 \mathbin\| \cdots \mathbin\| m_\ell$, up to $\ell \leq 2^{55} + 1$ blocks ...


4

You can use a 16-bit truncation of MD5 or SHA-1 or SHA-256 or SHAKE128 as a checksum, but it's not a good checksum. Why not? Let's model them by a uniform random function of $t$ bits, which is a reasonable model in this scenario. In this case, $\Pr[H(x) = h] = 1/2^t$ for any message $x$ and hash $h$, and every $H(x)$ is independent for each distinct $x$. ...


4

Running Argon2 (or any other key-stretching KDF) twice to generate two different keys (or other outputs) from the same password is not a good idea, since it makes key derivation twice as slow while not making the password any harder to crack by brute force. Or, in other words, it makes the password twice as fast to crack compared to just running the KDF ...


4

Yes, SHA-256 is defined to give the same output for the same input byte sequence on every platform. However, by design, even the smallest change in the input will change the output into something completely different. So the most likely reason for the discrepancy you observed is that the input you used is not actually the same as the original input from ...


4

We like to think of hash functions as random functions, and there is no reason a random function shouldn't have a cycle of size 3 which is what you describe. Obviously it would be very difficult to find such a cycle, we can discuss how likely is it a random function over space size $n$ has a cycle of size 3. Ignoring cycles of size 1 and 2 which acount for ...


4

I'd split the key into two 256 bit keys using HKDF, and use one key for the GCM mode, and the other for the hash over the plaintext. However, I then would use HMAC rather than SHA-256 as it accepts and the key as a separate entity in the application. The advantages of the HKDF key derivation function is that there is more "distance" between the keys used ...


4

I seem to recall that shared secret keys should be hashed before using as encryption keys (some brief discussion here). If your key is already high-entropy, then hashing with SHA256 is fine. If you plan to generate several keys (ie, encryption and HMAC) from the original shared secret, then HKDF is a good option. This is a key-based KDF. Scrypt and ...


3

How to prove that finding a cycle in a cryptographic hash function is hard? In a uniform random function on a space of $n$ elements, the distribution on the length $s$ of a chain starting at any $x$ before it repeats, i.e. the smallest $s$ such that $h^s(x) = h^{s - q}(x)$ for some $q < s$ or equivalently the number of distinct elements in $\{x, h(x), h(...


3

I read that something like this might be insecure as hashes become less secure the more often you hash them again. While this is technically true, you shouldn't worry about it. This paper has precise bounds on how bad it is to iterate a random function and with the iteration count $r<10$ as you are worrying right now this is a non-issue for security. ...


3

From reading the Argon2 paper, it would be safe, but not wise, to use SHA-256 instead of Blake2: We allow to choose another compression function G, hash function H, block size b, and number of slices ℓ. However, we do not provide this flexibility in a reference implementation as we guess that the vast majority of the users would prefer as few parameters ...


3

It is not normal. If you are correct that the inputs are identical (same line termination, same character encoding, etc), and you're comparing the same kind of representation of the checksum (bits to bits, hex to hex, whatever), then there is a bug in one of the devices. SHA-256 when it works correctly is a pure function. The SHA-256 hash of "123" must ...


3

SHA-256 is defined at the bit/byte level. A given sequence of bytes has exactly one SHA-256 value. Any other would be incorrect. However a given string instance may be encoded in different ways into a byte sequence. The string may differ in how whitespace is represented, or whitespace may be skipped. The characters in the text may also differ. All this may ...


Only top voted, non community-wiki answers of a minimum length are eligible