Is a length padding technique in a hash function used to avoid length extension attacks ?
14042
I understand the need for padding in MD5. But why do we append the message length to the padding?  I heard it strengthens the hash but how?  Please provide an example if possible and how it applies to this quote:     The inclusion of the length-block effectively encodes all messages such   that no encoded input is the tail end of any other encoded input.   Why a message being the tail of another message is bad (if it is)?
90197
This is hypothetical as I can't think of any reason to do this, but out of curiosity...  Could I, for example, take the MD5 digest of a message and concatenate it with the SHA-1 digest (not quite broken, but getting close), to form a secure concatenated digest? Intuitively, I would think the chances of finding a collision that crossed the two algorithms would be low enough to make this secure, but I'm not sure how to verify that.
39627
I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1:     Step1 Append padding bits      The input message is "padded" (extended) so that its length (in bits)   equals to 448 mod 512. Padding is always performed, even if the length   of the message is already 448 mod 512. Padding is performed as   follows: a single "1" bit is appended to the message, and then "0"   bits are appended so that the length in bits of the padded message   becomes congruent to 448 mod 512. At least one bit and at most 512   bits are appended.       Step2. Append length      A 64-bit representation of the length of the message is appended to   the result of step1. If the length of the message is greater than   2^64, only the low-order 64 bits will be used.  The resulting message   (after padding with bits and with b) has a length that is an exact   multiple of 512 bits. The input message will have a length that is an   exact multiple of 16 (32-bit) words.       ... algorithms steps   I read that hose 2 steps are always the same for input messages for MD4, MD4 and SHA-1. How about  SHA-224 / SHA-256 / SHA-384 / SHA-512? How do they 'prepare' input to compute a hash? The same way maybe?
91108
We are currently developing a little AES implementation in a crypto-course at university.  As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into blocks of 128 bits (16 bytes) into a 2d-array (or 1d in implementation) with 4 &times; 4 fields.  I was wondering and didn't find out what to do if the entered string to encrypt is not 128 bits long? The question is going further by thinking that there will never be exactly n &times; 128 bits of data to encrypt.  For a smaller key given by the user (e.g. "test") I know there is a key expansion algorithm defined.  But what should be done for data that is less than 128 bits?
114868
In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve).  Hence, isn't it impossible to have a perfect hashing algorithm? Aren't MD5, SHA-*, all flawed in this respect?  Is an "ideal hash" impossible to achieve?
17859
Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)?  If the answer is no, then how can SHA-1 be considered broken?
63155
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography make my old data insecure.  If I use only one hash algorithm, I can have bad luck to pick just the one which will be broken after some years.  For example,  (published 1990) had first collision attacks in 1995, and as of 2007 these are even cheaper than calculating the hash itself.  So, the idea would be to combine multiple such algorithms in a way that breaking just one (or some) of them does not compromise the security of the combined construct - breaking all of them would be necessary.  I do not care about efficiency loss from calculating multiple hashes instead of one, I just want to be sure against better cryptanalysis.  So, if I have hash functions $H_1$, $H_2$, ..., $H_n$. How to combine them to form a hash function which is as secure as any of them?  Two basic ideas, which do not work as intended:   simple concatenate the outputs:  $H_1(m) || H_2(m) || ... || H_n(m)$.  This should be quite secure against collision attacks, but is only as secure to preimage attacks as the weakest of them (and the other ones then can be used to check if I found the right preimage). chaining the functions: $H_1(H_2(...(H_n(m)...))$  For preimage attacks, you would now need to break all of them. But a collision in Hn trivially leads to a collision in the result, too. (Collisions in the others are less easy to exploit, as you then need to have to get preimages in the previous ones.)   Any better ways of combining them? Or is this a stupid idea at all?    To clarify: I do not really need more security than the hardest of the component functions, but I want at least that much. (And using more space is not really a problem here.)  And for preimages, I'm now mainly concerned about someone finding the original preimage (which is around the size of the hashes output),  and it looks like this will be at most as difficult as for the weakest hash, in the case of simple concatenation. I'm not so much concerned about someone constructing a new one - this sounds quite difficult, but is not so much, if the size of the message can grow as needed (one block per bit of hash or such) and we have collision attacks on the compression function, as Joux shows.
47155
The AEAD construction for chacha20-poly1305 described in the  encodes message lengths into the text that is to be hashed. The  goes further and pads associated data and plaintext to multiples of 16 bytes.  Can anyone explain what the purpose of that is? The chacha20-poly1305 implementation found in OpenSSH doesn't do anything like that, and as far as I can see, neither does NaCl. Those are still considered secure so I wonder what's going on.
89444
Assuming I'm a bank which seeks for secure hash functions to use in the process of  signing on digital contents.  I'd like to explain / prove why using each one of the following hash functions might be less secure than using SHA-1 (yes, I know SHA-1 no longer considered secure, but the question does consider it as one, or at least states "do not be less secure than sha-1").   $h_{666}(m) = $ some new hash function with 666 bit long output. $h_{ib}(m)=h_{sha-1}(h_{md5}(m))$ $h_{hm}(m)=h_{md5}(m) \oplus h_{sha-1}(m) \oplus h_{ib}(m) \oplus h_{666}(m)$, while the XORing operation here xors the matching bits between two outputs, padding with 0s the smaller ones.   I would say…   I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer. md5 is broken and collisions can be made quite easy, so two different inputs to this function can collide and have the same input to the sha-1 function, which will result in collision between the final outputs. I have no clue how to disqualify this one. The intuition says 'xoring with bad hash functions is not a good idea', but I can't really justify my answer. I also think the padding doesn't actually affect anything, becuase if SHA-1 result is secure then padding 0s to it won't make it collide with other inputs suddenly.   Am I correct, or did I miss something obvious somewhere?  Edit  This is different from  since here the idea is to combine unsecure hash with a secure one. This is not about just combining hashes.
115825
Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M?  If yes, how do I go about (efficiently) finding such a pair?
100840
Is it better to encrypt a plain text file before compression, or vice versa?
55728
defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks:     it is possible to use an XOF as a hash function by   selecting a fixed output length. However, XOFs have the potential for generating related   outputs—a property that designers of security applications/protocols/systems may not expect of   hash functions   Later it describes a theoretical use case (and explicitly discourage such uses):     For example, a naïve (and non-approved) way   for two parties to agree to derive a 112-bit Triple DES key from a message designated as keymaterial would be to compute SHAKE128(keymaterial, keylength), where keylength is 112.   However, if an attacker is able to induce one of the parties to use a different value for keylength, say 168 bits, but the same value for keymaterial   So what is the use case for these functions? Is there any reasonable use case where these functions should be used instead of standard (fixed-size output functions) SHA-3 functions?
65100
Are there any cryptographic hash functions for which there is a known pre-image attack, or a known second pre-image attack, but not both?  The attack doesn't have to be practical - just anything that beats the security claim of the hash function.  Intuitively, 2nd pre-image attacks would be easier to find than pre-image attacks, but I'm not aware of any examples or that either property implies the other.  I believe there are no known pre-image attacks on the common crop of hash functions in use today, so I'm interested in historic, obsolete and proposed-but-not-adopted hash functions, but  constructed specifically to demonstrate the possibility of such attacks.
52028
We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256. Alice discloses a value $h$, claiming that she (or/and parties she can communicate with or/and devices they have access to) knows a message $m$ such that $H(m)=h$. Can some protocol convince Bob of this claim without help of a third party/device that Bob trusts, nor allowing Bob to find $m$? At Crypto 98 rump session, Hal Finney made a 7-minutes presentation  which seems to be intended for that. This remarkable result is occasionally stated as fact, including  and . But I do not get how it is supposed to work. Update: This talk mentions using the protocol in the Crypto'98 paper of Ronald Cramer and Ivan B. Damgård:  ( is very similar, or there is ).
70667
When I need to generate unique id's based on some information hashing is typical choice. However, sometimes that id needs to be of a particular size.  I've seen a lot of schemes (HMAC-MD5-96 in SSH, CGA in SeND for IPv6) that use a portion of a hash, so I'm thinking it might be alright to use it that way.    Which properties of a hash are preserved and which do not apply anymore?  Obviously, with less bits, the chance of collision goes up, but can I still rely on the partial hash for uniform character distribution?  What about the ?  I'm guessing that if a hash modifies the entire hash upon the smallest change to the input, that would imply that a portion of that hash would be equally well changed.  Am I thinking about this correctly?  Also, would these behaviors be different for different hashing algorithms?
41456
CSPRNGs have 2 design requirements:   output unpredictability,  back-tracing resistance.    In addition to which,  added other features such as a) instance customization/personalization, b) operation administration (reseeding counter, etc.).   Of the three functions listed on , key and salt generation can be accomplished with any KDF (even ones based on plain hash functions), and nonce can be accomplished with a simple counter.   And with the introduction of dedicated-purpose XOFs in the SHA3 standard, the problem of producing arbitrary-length string from a finite-length one becomes solved along the way.   Both XOFs and KDFs are much easier to implement and use practically, so what's the point of designing DRBGs in the "NIST-SP-800-90A" way?
90368
If I understand correctly in (unpadded) RSA the length of message M must be shorter than modulus n.  Encryption gives ciphertext that is also shorter than n.  Let's say I want to send a message of 2.5x length of n.  Is the split of message into chunks inferred somehow, or is that encoded somehow within ASN.1 keys? What are the different options/standards for this?  EDIT: Probably RSA is not used for messages longer than n but symmetric keys are generated with RSA and then they are used for longer messages?