Live data from Hacker News

Lifetimes of cryptographic hash functions

valerieaurora.org

31–40 of 56 posts

Re: Lifetimes of cryptographic hash functions

#31
post #29

Earlier quoted context omitted.

This is actually a pretty interesting question. The answer, at least for Merkle-Damgard hash functions (MD5, SHA-1, SHA-2, etc) is that concatenating (or "cascading") hash functions doesn't really improve the strength of the resulting construction. Merkle-Damgard hash functions look like this: function MD(M, H, C): for M[i] in pad(M): H := C(M[i], H) return H For message M, initial state H, and compression function C…

Ah, so in fact the naive concatenating solution I gave, in addition to being just as easy because the attacker only has to break half of it, is actually even easier because the attacker has two targets to collide with. What about non-concatenative methods? For example, could you do something like "shift and xor". For example, say you have a 4-byte hash function, so that: hash(salt + input) : 0x3AF9 hash(salt + fixedS…

> Ah, so in fact the naive concatenating solution I gave, in addition to being just as easy because the attacker only has to break half of it, is actually even easier because the attacker has two targets to collide with.

I wouldn't say it's easier. Remember that we need to find a single message that generates a collision under both hash functions. So our strategy is to generate a massive number of collisions for the shorter function and hope that there's one pair of messages in there that collide under the longer function.

> What about non-concatenative methods?

I think this will again boil down to finding a single message that generates a collision under both hash functions. It won't matter too much whether you XOR the hashes or concatenate them.

Re: Lifetimes of cryptographic hash functions

#32
If the SHA-2 family have weaknesses, and SHA-2 is used for generating Bitcoin blocks, whoever breaks this first will be an overnight millionaire, just make sure you break them slowly (about 20 a day max) to avoid suspicion that the hashing is compromised. Sell as much as possible and then release your paper.

Re: Lifetimes of cryptographic hash functions

#33
post #31

Earlier quoted context omitted.

Ah, so in fact the naive concatenating solution I gave, in addition to being just as easy because the attacker only has to break half of it, is actually even easier because the attacker has two targets to collide with. What about non-concatenative methods? For example, could you do something like "shift and xor". For example, say you have a 4-byte hash function, so that: hash(salt + input) : 0x3AF9 hash(salt + fixedS…

> Ah, so in fact the naive concatenating solution I gave, in addition to being just as easy because the attacker only has to break half of it, is actually even easier because the attacker has two targets to collide with. I wouldn't say it's easier. Remember that we need to find a single message that generates a collision under both hash functions. So our strategy is to generate a massive number of collisions for the…

Hmm. It still seems to me that the simple concatenative method could still be broken at least slightly more quickly, since each function can be collision tested separately, but my brain is vaguely gesturing at comprehension about why xoring is still weak.

I feel like we should be teaching the principles of crypto to young children so that we end up with some humans that can grok it as easily as the rest of us do algebra. But there are a great many things I would want young children to be taught if I were made the Benevolent Dictator of All School Boards.

Re: Lifetimes of cryptographic hash functions

#34
post #5

Confession time: i still have some apps with salted md5 hashed passwords

You shouldn't be using any of the functions on that page directly, anyway: http://throwingfire.com/storing-passwords-securely/#notpassw...

But it does matter, because if you can exploit a weakness in the hash function you can figure out the salt, strip it, and then use your precomputed dictionary.

Re: Lifetimes of cryptographic hash functions

#35
post #34
post #5

Earlier quoted context omitted.

You shouldn't be using any of the functions on that page directly, anyway: http://throwingfire.com/storing-passwords-securely/#notpassw...

But it does matter, because if you can exploit a weakness in the hash function you can figure out the salt, strip it, and then use your precomputed dictionary.

[deleted]

Re: Lifetimes of cryptographic hash functions

#36
post #34
post #5

Earlier quoted context omitted.

You shouldn't be using any of the functions on that page directly, anyway: http://throwingfire.com/storing-passwords-securely/#notpassw...

But it does matter, because if you can exploit a weakness in the hash function you can figure out the salt, strip it, and then use your precomputed dictionary.

That's not really how it works. Either way, you shouldn't be using just a regular "hash function" anyway. Even basic constructions like PBKDF2 use HMAC constructions where SHA1 and even MD5 are still pretty safe to use (although not very computationally expensive.)

Re: Lifetimes of cryptographic hash functions

#37

If the SHA-2 family have weaknesses, and SHA-2 is used for generating Bitcoin blocks, whoever breaks this first will be an overnight millionaire, just make sure you break them slowly (about 20 a day max) to avoid suspicion that the hashing is compromised. Sell as much as possible and then release your paper.

Indeed, bitcoin is like a cryptography competition with ridiculously huge prize.

1. Break SHA2 -> control bitcoin generation ($2500 each generated block at current prices)

2. Break ECDSA -> unlock any addresses that have ever sent money on the blockchain

3. Break ECDSA+SHA2+RIPEMD160 -> break ALL addresses, even those that have never sent money.

Incidentally, the difference between 2 and 3 is why it is not recommended to reuse bitcoin addresses.

Re: Lifetimes of cryptographic hash functions

#39
post #4

Why is SHA-2 orange? As far as I know, besides length-extension, there's no known weakness on the full hash function.

https://en.wikipedia.org/wiki/Comparison_of_cryptographic_ha...

or more specifically: http://dx.doi.org/10.1007/978-3-642-38348-9_16 and http://eprint.iacr.org/2010/016.pdf

Post reply on HN