New answers tagged sha-256
7
SHA-1 is broken in practice in terms of finding collisions. This shattered attack (identical-prefix collision attack) requires roughly $2^{63.1}$ SHA-1 evaluations and this is approximately 100,000 faster than finding collisions with generic birthday attack on 160-bit output that has $2^{80}$- time complexity. That is, for a hash function with $\ell$-bit ...
4
The approximate way
You don't need to be perfectly even if you can make the unevenness small enough to be undetectable. So you can realistically do this: take the first 128 bits (16 bytes) from the SHA-256 output (or more, if you like), read them in as an unsigned bignum (arbitrary precision integer) using your library of choice, take the remainder modulo 6,...
3
From RFC 8446, the hash is used for:
The transcript hash, covering every message in the handshake to authenticate it during key agreement and certificate verification (§4.4.1).
Deriving various session keys from raw key agreement material and transcript hash with HKDF (§7.1).
Deriving key material for protocols based on the key negotiated in a TLS session (...
1
There are other tools in TLS 1.3 that you didn't list. From section E.1.1.
in RFC8446
E.1.1. Key Derivation and HKDF
Key derivation in TLS 1.3 uses HKDF as defined in [RFC5869] and its
two components, HKDF-Extract and HKDF-Expand.
HKDF is HMAC-based Extract-and-Expand Key Derivation Function and defined in rfc5869
The HMAC requires the ...
0
Any experiment made with SHA-256 or any truncation of that, devised without knowledge of SHA-256 (or just without knowledge of its constants h0..h7), and with input length constrained to block the length extension property (e.g. fixed), should conclude that the output behaves like uniform random, except that identical input leads to identical output.
Any ...
7
If this provided any insight, we would consider SHA-256 to be broken. In general, we expect the $n$-bit truncation of SHA-256 to resemble an $n$-bit uniform random function. For example, finding a 10-bit partial preimage costs an expected ${\approx}2^{10}$ trials; finding a 10-bit partial collision costs an expected ${\approx}2^5$ trials.
That said, there ...
1
Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective.
You seem to be using the standard technical term ‘uniform distribution’ in a confusing way. Normally the uniform distribution on a finite set $A$ means the probability distribution $P$ with $P(x) = 1/\#A$ for all $x \in A$, ...
-1
Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective.
No. This is not a cryptographic hash (what I call a pseudo random function). Simplistically: Hash -> avalanche effect -> bin collisions -> 37% rate -> non injective -> codomain =/= domain.
You may be over thinking this. ...
1
The answer depends on how you define ‘convergent encryption’ and what threats you're hoping to defend against. Here are two broad options that you might mean:
You're a storage service and you make lofty promises about encryption to your users, but you also do deduplication between unrelated parties. (Maybe you abuse the term ‘zero-knowledge’; it's trendy ...
Top 50 recent answers are included
