Hot answers tagged

61 votes
Accepted

How can hashes be unique if they are limited in number?

how can for example SHA-256 be unique if there is only a limited number of them?! Where your issue occurs is that they're not unique. It's just very improbable that they'll reoccur. Unique in ...
Paul Uszak's user avatar
  • 15.3k
32 votes

How can hashes be unique if they are limited in number?

You are right, hashes won't be all unique as you already have shown. The important part are practical collisions - how many SHA-512 hashes can the whole earth generate in its lifetime? Definitely much ...
Nova's user avatar
  • 3,880
30 votes
Accepted

Dropbox Password security

Is this really more secure than using bcrypt with a complexity of 11 or 12 ? It depends. Obviously if you consider everything on their servers compromised this isn't more secure than using a higher ...
SEJPM's user avatar
  • 45.9k
19 votes

Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

The only differences in calculations are the initial value and the output size. From NIST FIPS 180-4 The initial hash value, $H^{(0)}$, shall be set as specified in Sec. 5.3.4; and The 384-bit ...
kelalaka's user avatar
  • 48.3k
16 votes
Accepted

Why is SHA-512 limited to an input of $2^{128}$ bits?

The standard FIPS.180-4 defines a padding scheme that limits the upper input size. Then append the 128-bit block that is equal to the number $l$ expressed using a binary representation. Where ...
kelalaka's user avatar
  • 48.3k
15 votes
Accepted

Is deriving the IV from the password secure?

Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
Maarten Bodewes's user avatar
  • 92.4k
14 votes

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
Maarten Bodewes's user avatar
  • 92.4k
14 votes

Dropbox Password security

I understand that the Global "pepper" means that a DB dump protects the hashes until that pepper is found, and then each hash is still salted per user, but how much would that slow down people ...
Luis Casillas's user avatar
13 votes

Does SHA-512 leak info about SHA-256?

does publishing a SHA-256 fingerprint of that shared secret reveal any useful info about the derived keys? No such leakage is known, and it would look quite unlikely. The SHA-256 and SHA-512 ...
poncho's user avatar
  • 146k
13 votes

SHA-512 faster than SHA-256?

Benchmarks I would like to see also some real-life measurements here, so I hope you'll like it ;) Intel Core i7-7700HQ (7th gen = Kaby Lake); RAM (DDR4) HW / OS configuration: System: Linux Mint 20....
Vlastimil Burián's user avatar
12 votes
Accepted

Benchmark differences between SHA-512 and bcrypt

SHA-512 is a cryptographic hash while bcrypt is a password hash or PBKDF (password based key derivation function). SHA-512 has been designed to be fast. You don't want any delays when validating a ...
Maarten Bodewes's user avatar
  • 92.4k
9 votes

How can hashes be unique if they are limited in number?

A 256-bit hash has about one million times as many numbers as the Milky Way has atoms (give or take a few hundred atoms...). So that's not just a limited number, it's a pretty big limited number. ...
Damon's user avatar
  • 928
9 votes
Accepted

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different ...
fgrieu's user avatar
  • 140k
8 votes
Accepted

Transforming SHA-512 into SHA-512/256?

Like Richie Frame commented, as SHA-2 padding uses the length of the message that is not possible. Specifically, even if you had some string of input that took you from the SHA-512 IV to the SHA-512/...
otus's user avatar
  • 32.1k
8 votes

Why is SHA-512 limited to an input of $2^{128}$ bits?

Considering SHA-512 has a higher output size Here's where I think you're making a mistake. The space of the output of SHA-512 is $2^{512}$. However, the number of possible inputs is not $2^{128}$, ...
forest's user avatar
  • 15.2k
8 votes

Are there parts of a SHA-512 hash that occur more often then others?

In short: Will every possible 'final' password be equally likely? Yes, we expect that they equally likely. Cryptographic hash functions expected to have a well-distributed output. If you find any ...
kelalaka's user avatar
  • 48.3k
8 votes

Why SHA-512/256 when we already have SHA-384?

The truncated versions of SHA2 are introduced in 2005 and in the Cryptographic hash Workshop, in 2005, Kelsey listed the reasons as; Interoperability and security reasons Need drop-in replacement for ...
kelalaka's user avatar
  • 48.3k
8 votes

SHA-512 - How difficult is it to find a hash digest beginning with at least twelve zeros?

First, we need to model SHA-512 as uniform random. Start hashing random values. In hex we have 4-bits We would expect about 1 in $2^4$ values to have a hash-value with ...
kelalaka's user avatar
  • 48.3k
7 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

There's no point in using either an ASIC or a GPU to calculate a single password hash. That's true whether you use PBKDF2 or scrypt or Argon2 or whatever. What massively parallel devices like GPUs ...
Ilmari Karonen's user avatar
7 votes

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

Using different initial values means that finding collisions must be done independently for both algorithms. This is admittedly not an authoritative source, but I found the description in this answer ...
thesquaregroot's user avatar
7 votes

HMAC-SHA-512 output randomness?

Out of the $10001$ possible outputs $7295$ occur with a probability exactly equal to $429497$ in $2^{32}$. $2705$ occur with a probability exactly equal to $429496$ in $2^{32}$. One value, ...
Future Security's user avatar
6 votes

Does a Vigenère cipher with SHA-512 and a little foresight turn into a one-time pad? How safe can it be?

Is this a real one-time pad? No, it's not a one time pad; as the keystream is not generated from a truly random process, hence you don't get the informational security guarrantees that you'd get from ...
poncho's user avatar
  • 146k
6 votes

What is the length field in SHA-512 padding?

In $\text{SHA-512}$ the size of the blocks is 1024 bit. The last block must contain: the rest of data in message (mod 1024). some filling (padding) the last 128 bits as ...
Ibrahim Albarki's user avatar
6 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

The question correctly finds that In the case of PBKDF2, you will need to buy an ASIC to be ideal and proceeds assuming the legitimate server does that; or at least, uses a GPU as substitute. ...
fgrieu's user avatar
  • 140k
6 votes

Is it possible to generate an infinite number of collisions given an infinite amount of strings?

Yes and no. SHA-512 is by definition limited to strings of at most $2^{128}$ bits long. So there is only a finite set of possible inputs, not an infinite set. But you're guaranteed to have many ...
Squeamish Ossifrage's user avatar
6 votes
Accepted

Which algorithm should be used to replace SHA512withRSA?

In standard Java libraries, SHA512withRSA designates signature per RSASSA-PKCS1-v1_5 with SHA-512. There is no known attack when used with a sufficient RSA modulus ...
fgrieu's user avatar
  • 140k
6 votes
Accepted

Strength of Sha512Ctr PRNG

Your proposal is more or less what NIST SP 800-90A describes as "Hash_DRBG". From a pure cryptographic point of view, there's nothing bad with it. A few remarks can be made from a more engineering ...
Thomas Pornin's user avatar
6 votes
Accepted

What is SHA-512's input space, taking into account variable message size?

There is one zero-length message, two 1 bit long messages, four 2 bit long messages, eight 3 bit long messages, and so on. Since these messages are distinct, you can simply use the formula: $$1 + 2 + ...
Future Security's user avatar
6 votes
Accepted

Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?

By performing two PBKDF2 computations in parallel and combining the results, you're increasing the effort it would take an attacker to break the keys without increasing the amount of time it takes you ...
forest's user avatar
  • 15.2k
5 votes
Accepted

Is it possible to work out the hash using length extension attack but with different hashes type?

This is not possible in general, or for the specific case of SHA1 and SHA512. Length extension works because MD-hashes iterate the same function, so knowing the output you also know the intermediate ...
otus's user avatar
  • 32.1k

Only top scored, non community-wiki answers of a minimum length are eligible