# Tag Info

21

First of all, the output of SHA-256 is binary and consists of 32 bytes (256 denotes the output size in bits). What you are talking about is apparently the hexadecimal encoding of these bytes. The possibility that you are talking about is called (1st) pre-image resistance (Wikipedia): Given a hash value $h$, it should be difficult to find any message $m$ ...

20

Strictly speaking, all hash functions are compressing since the output can be smaller than the input, but I imagine you're asking about compressing data that can later be losslessly decompressed. This is impossible due to the pigeonhole principle. The fact that the fixed output space of a hash algorithm is smaller than the input space means that there will ...

16

Since the initial release of Bitcoin is 9 January 2009, the designer had these NIST hash functions (NIST-FIPS 180-4) as available options: SHA-1( 1995), SHA-256 (2001), SHA-512 (2001), and some more. The main difference between SHA-256 and SHA-512 is the target CPU. SHA-256 is designed for 32-bit CPUs and SHA-512 is designed for 64-bit CPUs. That makes a ...

15

Yes, it's possible. Given the size of the input space (not actually infinite, but still very, very large), it's also likely, for any given 256-bit value, that several inputs that hash to that value exist. No, there's nothing special in the construction of the algorithm that prevents it (restricting the output space would probably be bad for security). ...

11

There is actually a system for hash based signatures being standardized, see here. Hou have described a system where the public key is derived from the private key in such a way that the private key cannot be recovered from the public key. However, it is unclear what operations you can perform with the public key that can only be reversed by persons having ...

11

$2^{64-1}$ bits that make 2.30584301 exabytes *. If you are not restricted to SHA256, then use SHA512 that allows files to have size at most $2^{128}-1$, or use SHA3 that has no limit. The NIST must use a limit due to the artifact of the MD construction. SHA256 is standardized in 2001 along with SHA512. They have internal block size 512 and 1024 respectively,...

10

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can withstand attacks for a long time with a good design. SHA-1 (1995) has 160-bit output, which results in 80-bit generic collision resistance. It was good for ...

10

If the question was about (current form) Reversible cryptographic hash functions Then No! One-wayness property of the cryptographic secure hash functions will prevent that. Hash functions don't use keys. So if you can reverse, everybody will reverse and there will be no secure hash function at all. Besides, mathematically impossible, too; hash functions use ...

9

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO checksum, Bob doesn't notice that he has downloaded fake ISO I highlighted the incorrect assumption: the checksums wouldn't match. What the length extension attack ...

8

Comparing double sha256 to sha512 is like comparing apples to oranges. For one, the result of sha512 is 512 bits in length. The result of double sha256 (or triple sha256, or quadruple sha256, for that matter) is 256 bits in length. There has been a lot of conjecture over the years as to why the creator of bitcoin chose to use double sha256 in the protocol. ...

8

I could base a public and private key system just using a hashing algorithm Hash based signatures, such as Sphincs+, are essentially this (except that the relation between private key and public key is a tad more complicated. However, to answer the question you appear to be answering: the problem with developing a public key cryptosystem is not just the ...

7

Let us consider a simple string in Hex: 2E Its SHA value is: cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8 Yes, that's correct. When converted into byte form should we write 46 or 046. Neither. The whole idea of using hexadecimals for bytes is to represent the value of the bytes. So 2E is the hexadecimal representation of a single byte. ...

6

The typical reason one uses double hashing is to deal with length-extension attacks. That's because any Merkle-Dåmgard algorithm that outputs its entire state (e.g., SHA-1, SHA-256, and SHA-512) is vulnerable to a length extension attack, where users who know a hash can append additional data and also produce a valid hash. There are other algorithms, such ...

6

The size is just restricted by a length encoding at the end of the last block that is hashed using SHA-256 - one of the two main hash functions that make up the SHA-2 family. If you extend that size then you'd have your secure hash function with extended input. However, there is an easier way. The SHA-512 hash function - the other main hash function in the ...

6

Background Terminology Injective : one-to-one Surjective : onto Bijective : one-to-one and onto. Pigeonhole-Principle The pigeonhole principle goes back to 1624. We can state it as; if there are $m$ pigeons and $n$ holes with $m>n$ then when the pigeons are placed into the holes, there is at least one box that has more than one pigeon. We can look at ...

6

But would that also be possible practically, or do the algorithms check that this is not happening? This is practically beyond anybody to find a 32-$a$'s for SHA-256 without pure luck or one need breaking the pre-image resistance of SHA-256, that is not possible. Is it possible that a SHA256 hash has the same character 64 times? Yes, and No. We don't know ...

5

SHA-256 and SHA-512 were designed to be very fast. Their primary goal ist to verify the integrity of long messages or files. Long means not 10-12 bytes but some megabytes and greater. It is not a good idea, to use hash function that is fast by design for password hashing. Instead, for password hashing should be used functions that need essentially more ...

5

If we're using the cyphersuite TLS_AES_128_GCM_SHA256; and GCM is using Encrypt-then-MAC (which appears to be always?) and is configured to use a 128-bit tag; and AES_128 is encrypting plaintext in blocks of 128 bits; then is GCM adding a 128-bit tag onto each one of those blocks (thus, halving the amount of cyphertext that can ultimately fit into the data ...

5

You can't completely precalculate 1111, however, you can completely precalculate messages that have a length multiple of 512. The reason is simple, SHA-256 uses 512-bit message block per compression, i.e. the compression function of SHA-256 uses 512-bit message inputs and 256-bit previous hash values. $$C:\{0,1\}^{256}\times \{0,1\}^{512} \to \{0,1\}^{256}$$ ...

5

Then I would like to have a proof that the user has/knows the key K. The key will be hashed once with a SHA256 function and the result H will be stored in a database (SHA256(key)). So, whenever I will need to verify that the user has the key K, it will be hashed on frontend and only the H value will be sent to the server, so I can compare it with the value ...

5

The short answer, the GitHub project has a long way to see that it is almost impossible to do. 4-round attacking has nothing compared to 64 rounds of SHA-256. And the note of the author tells this too; As a disclaimer: I do not claim that any of these methods break the security of the full 64-round SHA-256 hash function. It's probably still infeasible. ...

4

The other answers did not mention the Length-Extension attacks on the Merkle–Damgård construction. Length extension is given a hash value $h$; $$h = \operatorname{SHA-256}(\text{IV},\text{secret_key}\mathbin\|\text{known_data}\mathbin\|pad1)$$ the attackers can produce an extension as; \operatorname{SHA-256}(\text{IV},\text{secret_key}\mathbin\|\text{...

4

When we state that "SHA-256/SHA-512" hasn't been broken, what we mean is that the three security properties of hash functions haven't been violated. Those properties are: Preimage resistance; given a hash, value, it is hard to find a string that hashes to that value. Second preimage resistance; given a message, it is hard to find a second ...

4

TLDR: it's the DigestInfo The hash-and-RSA-PKCS schemes defined in Current Mechanisms 2.1.14 do the full scheme of RSASSA-PKCS1-v1_5 which is now defined in RFC8017 primarily in 9.2 as a combination of EMSA-PCKS1-v1_5 'encoding' (usually called padding) plus the RSASP1 and RSAVP1 primitives. (In prior versions the document was organized differently, but the ...

4

Is there a way how Alice can proof to Bob that she is in possession of the private key? Here is one possible way: Bob selects a random 2048 bit value $m < n$ and computes $m^e \bmod n$ and sends that and $\text{SHA3_256}(m )$ to Alice. Alice, with the private key, recovers $m$, and verifies that $\text{SHA3_256}(m)$ matches the value she received from ...

4

A salt is supposed to be publicly available, for instance it needs to be stored in a DB next to the password hash. In that case the time it takes to recover the password is just a brute force or dictionary for the password. If the salt is static then rainbow tables may be used as well for any attack. Now if the password has an entropy of 256 bits then this ...

4

What you are sharing is indeed (lapo.it ASN.1 decoder) a 1023 bit public RSA key. RSA keys can be used for multiple things such as signature generation. In that case the signature algorithm may use SHA-256 to hash the message, but the key itself doesn't care about the hash function used (you won't see it in the structure in the link). "private/public ...

4

No, breaking the collision property of SHA-256 does not require any close to $2^{128}$ space. We know how to exhibit collision in any $n$-bit hash $H$ with $\mathcal O(2^{n/2})$ hash evaluations and $\mathcal O(n)$ space. The simplest suitable method is Floyd's cycle finding, which will exhibit with non-vanishing probability two distinct $n$-bit bitstrings \$...

3

Your question is not very clear, but I assume you're asking whether the runtime of a SHA-256 invocation depends on anything about the input other than its length. In other words, if an adversary knows how long it takes to calculate SHA-256(M1) and SHA-256(M2), does this leak any information about M1 and M2 other than their length? The answer, with plausible ...

3

The basic idea of public key cryptography goes beyond simply having two keys. Instead you need the relationship between the keys and the algorithm that's used to allow data that's encrypted with the public key to be decrypted with the private key. Most encryption algorithms use the same key for both encrypting and decrypting the data. In fact, for a long ...

Only top voted, non community-wiki answers of a minimum length are eligible