Search Results

For instance, imagine an encryption algorithm defined the following way: for message M and key K, hash K with SHA-1, then use the first 128 bits of the SHA-1 output with AES to process the message M. … However, if you reveal SHA-1(K) then it becomes trivial to break it, even though you did not reveal K itself. …

Now the important notes: All of the above assumes that SHA-1 truncated to 64 bits (let's call it SHA-1/64) is as good against preimages as can be expected from a "perfect" hash function, and as SHA-1 … It can be shown that SHA-1/64 cannot be too weak against preimages, because a very fast attack against SHA-1/64 could be turned into an attack against the full SHA-1 which would be faster than 2160 (not …

It all depends on the context, which you do not specify. You want to be able to recreate the passwords for some reason; depending on that reason, inability to do it without a Linux machine at hand may …

For security, one important thing to take into account is that an exhaustive search on the master password is feasible. Schematically, an attacker who got a site-specific password (e.g. an evil admin …

It is known that MD5 and SHA-1 do not fulfil all these properties (because then they would also be ideally resistant to collisions, which they are not), but that just invalidates the proof. … Up to and including TLS 1.1, HMAC/SHA-1 is used in both roles, and that's not optional. Banning HMAC/SHA-1 would really mean enforcing TLS-1.2. …

Therefore, your truncated SHA-256 will offer "128-bit security" only in usage contexts where collisions are not an issue. … SHA-256 collisions are not feasible with existing technology. …

A cryptographically sound way is the following: from the shared key K, compute SHA-256(K). This yields 256 bits. …

By your scheme with a combination of SHA-2 and SHA-3, you would be on the right track to add one more person on the depressingly long list of people who felt that creativity was a good thing in cryptography … (None of this says anything about SHA-2 or SHA-3 as generic hash functions. …

From a business point of view, it rarely makes any good not to yield to the fashion du jour, so you should use one of the SHA-2 functions, e.g. SHA-256 or SHA-512. … There is no strong reason to prefer SHA-256 over SHA-512 or the other way round; some small, 32-bit only architectures are more comfortable with SHA-256, but this rarely matters in practice (even a 32- …

Hence, no problem with SHA-1 or, come what may, MD5 or MD2. …

Applying a hash function on the concatenation of the password and some other data is a custom MAC, and not a very good one with usual hash functions like SHA-512 because of the length extension attack. …

SHA-1 is not (at least, not as much). If your protocol requires resistance to collisions, then don't use MD5. … That MD5 is about 40% faster than SHA-1 won't actually matter, since the bottleneck is the disk, not the hashing. SHA-256 and SHA-512 are the currently recommended general purpose hash functions. …

SHA-1 and SHA-256 are cryptographic hash functions. They take as input an arbitrary sequence of bits -- and only that. There is no "salt" in hash functions. …

Using SHA-512 "as is", with or without some salt and regardless of how you inject the said salt in the engine, would not grant you the NIST approval. … NIST approves PBKDF2, as long as the underlying primitive used in PBKDF2 is itself "approved" (i.e. it is HMAC used with one of the SHA-2 functions). …

The definition of a cryptographic hash function includes resistance to preimages: given h(x), it should be infeasible to recover x. A hash function being "reversible" is the exact opposite of that pro …