Why this brute force attack doesn't reduce all cryptographic hash functions' security bits against collision attacks to N/3?Are cryptographic hash functions perfect hash functions?Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?Brute-force attack given multiple hash prefixesWould it matter if my miner was hashing random vs incremental values?Is this SHA256 hash implementation secure from rainbow table, brute forcing attacks?What are the odds of collisions for a hash function with 256-bit output?usefulness of a collision attack that's not also a 2nd pre-image attackIs there a way one can combine two correlated hash outputs to maximize the collision resistance?
Is the Amazon rainforest the "world's lungs"?
Commercial company wants me to list all prior "inventions", give up everything not listed
Can I get a PhD for developing an educational software?
Why does glibc's strlen need to be so complicated to run fast?
Did the Apollo Guidance Computer really use 60% of the world's ICs in 1963?
Counting the number of strings starting with "t" and containing 2 vowels and 2 consonants
Could the UK amend the European Withdrawal Act and revoke the Article 50 invocation?
Which meaning of "must" does the Slow spell use?
Count the number of triangles
Did anybody find out it was Anakin who blew up the command center?
Can an object tethered to a spaceship be pulled out of event horizon?
Drawing probabilities on a simplex in TikZ
Is there any problem with a full installation on a USB drive?
Can someone identify this unusual plane at airport?
Why did Lucius make a deal out of Buckbeak hurting Draco but not about Draco being turned into a ferret?
Is Nikon d500 a good fit for nature and ambient-lighting portraits and occasional other uses?
How could a self contained organic body propel itself in space
Unlock your Lock
How do solar inverter systems easily add AC power sources together?
Is there an in-universe explanation given to the senior Imperial Navy Officers as to why Darth Vader serves Emperor Palpatine?
Book featuring a child learning from a crowdsourced AI book
What was the point of "Substance"?
Why is there not a willingness from the world to step in between Pakistan and India?
Notice period 60 days but I need to join in 45 days
Why this brute force attack doesn't reduce all cryptographic hash functions' security bits against collision attacks to N/3?
Are cryptographic hash functions perfect hash functions?Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?Brute-force attack given multiple hash prefixesWould it matter if my miner was hashing random vs incremental values?Is this SHA256 hash implementation secure from rainbow table, brute forcing attacks?What are the odds of collisions for a hash function with 256-bit output?usefulness of a collision attack that's not also a 2nd pre-image attackIs there a way one can combine two correlated hash outputs to maximize the collision resistance?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
$begingroup$
The traditional brute force collision attack is generate $2^N/2$ (unique) random strings, hash them and this results in ~50% chance for collision.
The attack talked in the question's title is generate hashes by the sequence $H_0 = F(S), H_n = F(S||H_n-1)$, where $S$ is a string to make collision with, $F$ is the hash function, and the sequence stops at $2^N/3$.
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes. When hashing $2^N$ random strings, there will be $(1-(1-frac12^N)^2^N)2^N$ possible hashes because of all the collisions.
The sequence that tells the fraction of the possible hashes for each hash in the sequence is $P_0 = 1, P_n = 1 - (1-frac12^N)^2^NP_n-1$, which roughly approximates to $P_n = P_n-1 - fracP_n-1^22$ as $lim_P_n-1to 0$, which can be approximated into a function $P(n) = frac2n + 2$. (these reductions in precision make it easier for future calculations)
The chance for a collision to NOT happen for a hash in the sequence against all of it's following hashes is $C_n = (1 - frac1P_n2^N)^M - n - 1$ where $M$ is the sequence's length, because the fraction is so close to $1$, it can be approximated to $C_n = 1 - fracM - nP_n2^N = 1 - fracMn - n^22^N + 1$. Now to approximate the multiplication of all $C$s ($C_0C_1...C_M)$ to get the chance for collision for all hashes combined, we can discard the multiplication (because again, $C_n$ is very close to $1$) and add all the subtracted parts and subtract them from $1$, which results in $1 - fracM^3/2-M^3/42^N+1 = 1 - fracM^3/42^N+1$, and to reach ~50% collision rate $M = 2^(N+3)/3$, which is roughly just $2^N/3$.
Is there a reason why this won't work?
hash collision-resistance brute-force-attack
New contributor
$endgroup$
add a comment |
$begingroup$
The traditional brute force collision attack is generate $2^N/2$ (unique) random strings, hash them and this results in ~50% chance for collision.
The attack talked in the question's title is generate hashes by the sequence $H_0 = F(S), H_n = F(S||H_n-1)$, where $S$ is a string to make collision with, $F$ is the hash function, and the sequence stops at $2^N/3$.
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes. When hashing $2^N$ random strings, there will be $(1-(1-frac12^N)^2^N)2^N$ possible hashes because of all the collisions.
The sequence that tells the fraction of the possible hashes for each hash in the sequence is $P_0 = 1, P_n = 1 - (1-frac12^N)^2^NP_n-1$, which roughly approximates to $P_n = P_n-1 - fracP_n-1^22$ as $lim_P_n-1to 0$, which can be approximated into a function $P(n) = frac2n + 2$. (these reductions in precision make it easier for future calculations)
The chance for a collision to NOT happen for a hash in the sequence against all of it's following hashes is $C_n = (1 - frac1P_n2^N)^M - n - 1$ where $M$ is the sequence's length, because the fraction is so close to $1$, it can be approximated to $C_n = 1 - fracM - nP_n2^N = 1 - fracMn - n^22^N + 1$. Now to approximate the multiplication of all $C$s ($C_0C_1...C_M)$ to get the chance for collision for all hashes combined, we can discard the multiplication (because again, $C_n$ is very close to $1$) and add all the subtracted parts and subtract them from $1$, which results in $1 - fracM^3/2-M^3/42^N+1 = 1 - fracM^3/42^N+1$, and to reach ~50% collision rate $M = 2^(N+3)/3$, which is roughly just $2^N/3$.
Is there a reason why this won't work?
hash collision-resistance brute-force-attack
New contributor
$endgroup$
$begingroup$
Welcome to Cryptography. Could you elaborateThe above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes.
$endgroup$
– kelalaka
9 hours ago
$begingroup$
@kelalaka The sentence after that meant to support that statement, is it out of place?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka I didn't get the first 2 sentences. This is the same birthday attack just that the possible hashes are decaying overtime, so security is reduced.
$endgroup$
– Yanai Eliyahu
8 hours ago
add a comment |
$begingroup$
The traditional brute force collision attack is generate $2^N/2$ (unique) random strings, hash them and this results in ~50% chance for collision.
The attack talked in the question's title is generate hashes by the sequence $H_0 = F(S), H_n = F(S||H_n-1)$, where $S$ is a string to make collision with, $F$ is the hash function, and the sequence stops at $2^N/3$.
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes. When hashing $2^N$ random strings, there will be $(1-(1-frac12^N)^2^N)2^N$ possible hashes because of all the collisions.
The sequence that tells the fraction of the possible hashes for each hash in the sequence is $P_0 = 1, P_n = 1 - (1-frac12^N)^2^NP_n-1$, which roughly approximates to $P_n = P_n-1 - fracP_n-1^22$ as $lim_P_n-1to 0$, which can be approximated into a function $P(n) = frac2n + 2$. (these reductions in precision make it easier for future calculations)
The chance for a collision to NOT happen for a hash in the sequence against all of it's following hashes is $C_n = (1 - frac1P_n2^N)^M - n - 1$ where $M$ is the sequence's length, because the fraction is so close to $1$, it can be approximated to $C_n = 1 - fracM - nP_n2^N = 1 - fracMn - n^22^N + 1$. Now to approximate the multiplication of all $C$s ($C_0C_1...C_M)$ to get the chance for collision for all hashes combined, we can discard the multiplication (because again, $C_n$ is very close to $1$) and add all the subtracted parts and subtract them from $1$, which results in $1 - fracM^3/2-M^3/42^N+1 = 1 - fracM^3/42^N+1$, and to reach ~50% collision rate $M = 2^(N+3)/3$, which is roughly just $2^N/3$.
Is there a reason why this won't work?
hash collision-resistance brute-force-attack
New contributor
$endgroup$
The traditional brute force collision attack is generate $2^N/2$ (unique) random strings, hash them and this results in ~50% chance for collision.
The attack talked in the question's title is generate hashes by the sequence $H_0 = F(S), H_n = F(S||H_n-1)$, where $S$ is a string to make collision with, $F$ is the hash function, and the sequence stops at $2^N/3$.
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes. When hashing $2^N$ random strings, there will be $(1-(1-frac12^N)^2^N)2^N$ possible hashes because of all the collisions.
The sequence that tells the fraction of the possible hashes for each hash in the sequence is $P_0 = 1, P_n = 1 - (1-frac12^N)^2^NP_n-1$, which roughly approximates to $P_n = P_n-1 - fracP_n-1^22$ as $lim_P_n-1to 0$, which can be approximated into a function $P(n) = frac2n + 2$. (these reductions in precision make it easier for future calculations)
The chance for a collision to NOT happen for a hash in the sequence against all of it's following hashes is $C_n = (1 - frac1P_n2^N)^M - n - 1$ where $M$ is the sequence's length, because the fraction is so close to $1$, it can be approximated to $C_n = 1 - fracM - nP_n2^N = 1 - fracMn - n^22^N + 1$. Now to approximate the multiplication of all $C$s ($C_0C_1...C_M)$ to get the chance for collision for all hashes combined, we can discard the multiplication (because again, $C_n$ is very close to $1$) and add all the subtracted parts and subtract them from $1$, which results in $1 - fracM^3/2-M^3/42^N+1 = 1 - fracM^3/42^N+1$, and to reach ~50% collision rate $M = 2^(N+3)/3$, which is roughly just $2^N/3$.
Is there a reason why this won't work?
hash collision-resistance brute-force-attack
hash collision-resistance brute-force-attack
New contributor
New contributor
edited 8 hours ago
Yanai Eliyahu
New contributor
asked 9 hours ago
Yanai EliyahuYanai Eliyahu
133 bronze badges
133 bronze badges
New contributor
New contributor
$begingroup$
Welcome to Cryptography. Could you elaborateThe above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes.
$endgroup$
– kelalaka
9 hours ago
$begingroup$
@kelalaka The sentence after that meant to support that statement, is it out of place?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka I didn't get the first 2 sentences. This is the same birthday attack just that the possible hashes are decaying overtime, so security is reduced.
$endgroup$
– Yanai Eliyahu
8 hours ago
add a comment |
$begingroup$
Welcome to Cryptography. Could you elaborateThe above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes.
$endgroup$
– kelalaka
9 hours ago
$begingroup$
@kelalaka The sentence after that meant to support that statement, is it out of place?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka I didn't get the first 2 sentences. This is the same birthday attack just that the possible hashes are decaying overtime, so security is reduced.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
Welcome to Cryptography. Could you elaborate
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes.
$endgroup$
– kelalaka
9 hours ago
$begingroup$
Welcome to Cryptography. Could you elaborate
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes.
$endgroup$
– kelalaka
9 hours ago
$begingroup$
@kelalaka The sentence after that meant to support that statement, is it out of place?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka The sentence after that meant to support that statement, is it out of place?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka I didn't get the first 2 sentences. This is the same birthday attack just that the possible hashes are decaying overtime, so security is reduced.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka I didn't get the first 2 sentences. This is the same birthday attack just that the possible hashes are decaying overtime, so security is reduced.
$endgroup$
– Yanai Eliyahu
8 hours ago
add a comment |
2 Answers
2
active
oldest
votes
$begingroup$
It is correct that the set of possible $H_n$ over all the possible $S$ reduces as $n$ grows. However the attack evaluates the $H_i$ for a fixed random $S$, not for multiple $S$; thus that reduction is immaterial to the success of the attack.
In other words: it is evaluated the number of possible $H_i$ for random $S$ as a function of $i$, and from that drawn conclusions for collision probability among the $H_i$ for sequential $i$ and a particular $S$. The conclusions are thus not justified, and, it happens, quite incorrect.
When we model $F$ as a random function, then until there is a collision the $H_i$ are random, and hence the probability of collision among the $H_i$ with $0le i<n$ is per the birthday bound.
$endgroup$
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
1
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
|
show 2 more comments
$begingroup$
Let $M$ be the number of queries to a uniform random function $F$ at distinct points $X_1, X_2, dots, X_M$. The probability of a repeated value $F(X_i) = F(X_j)$ for $i ne j$ is at most $M^2!big/2^N$ by the birthday paradox. For $M = 2^N/3$, this is $2^2N/3!big/2^N = 1big/2^N - 2N/3 = 1big/2^N/3$. If your calculation doesn't fit this bound, there's an error in your calculation.
‘But what if we come upon a short cycle in $H mapsto F(S mathbin| H)$?’, you ask. The expected cycle length of a uniform random function is $frac12sqrt2pi,2^N approx 2^N/2$ (Harris 1960 Eqs. 3.2, 3.4, 3.11; paywall-free), so no, this method doesn't improve the expected cost.
Using a clever tortoise-chasing-hare algorithm to find a cycle, rather than making a big table and checking for duplicates, may reduce the memory or area*time cost of an attack, as in the van Oorschot–Wiener parallel collision search machine, but it doesn't escape the birthday bound!
$endgroup$
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "281"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Yanai Eliyahu is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f72850%2fwhy-this-brute-force-attack-doesnt-reduce-all-cryptographic-hash-functions-sec%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
It is correct that the set of possible $H_n$ over all the possible $S$ reduces as $n$ grows. However the attack evaluates the $H_i$ for a fixed random $S$, not for multiple $S$; thus that reduction is immaterial to the success of the attack.
In other words: it is evaluated the number of possible $H_i$ for random $S$ as a function of $i$, and from that drawn conclusions for collision probability among the $H_i$ for sequential $i$ and a particular $S$. The conclusions are thus not justified, and, it happens, quite incorrect.
When we model $F$ as a random function, then until there is a collision the $H_i$ are random, and hence the probability of collision among the $H_i$ with $0le i<n$ is per the birthday bound.
$endgroup$
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
1
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
|
show 2 more comments
$begingroup$
It is correct that the set of possible $H_n$ over all the possible $S$ reduces as $n$ grows. However the attack evaluates the $H_i$ for a fixed random $S$, not for multiple $S$; thus that reduction is immaterial to the success of the attack.
In other words: it is evaluated the number of possible $H_i$ for random $S$ as a function of $i$, and from that drawn conclusions for collision probability among the $H_i$ for sequential $i$ and a particular $S$. The conclusions are thus not justified, and, it happens, quite incorrect.
When we model $F$ as a random function, then until there is a collision the $H_i$ are random, and hence the probability of collision among the $H_i$ with $0le i<n$ is per the birthday bound.
$endgroup$
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
1
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
|
show 2 more comments
$begingroup$
It is correct that the set of possible $H_n$ over all the possible $S$ reduces as $n$ grows. However the attack evaluates the $H_i$ for a fixed random $S$, not for multiple $S$; thus that reduction is immaterial to the success of the attack.
In other words: it is evaluated the number of possible $H_i$ for random $S$ as a function of $i$, and from that drawn conclusions for collision probability among the $H_i$ for sequential $i$ and a particular $S$. The conclusions are thus not justified, and, it happens, quite incorrect.
When we model $F$ as a random function, then until there is a collision the $H_i$ are random, and hence the probability of collision among the $H_i$ with $0le i<n$ is per the birthday bound.
$endgroup$
It is correct that the set of possible $H_n$ over all the possible $S$ reduces as $n$ grows. However the attack evaluates the $H_i$ for a fixed random $S$, not for multiple $S$; thus that reduction is immaterial to the success of the attack.
In other words: it is evaluated the number of possible $H_i$ for random $S$ as a function of $i$, and from that drawn conclusions for collision probability among the $H_i$ for sequential $i$ and a particular $S$. The conclusions are thus not justified, and, it happens, quite incorrect.
When we model $F$ as a random function, then until there is a collision the $H_i$ are random, and hence the probability of collision among the $H_i$ with $0le i<n$ is per the birthday bound.
edited 8 hours ago
answered 8 hours ago
fgrieufgrieu
84.6k7 gold badges188 silver badges370 bronze badges
84.6k7 gold badges188 silver badges370 bronze badges
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
1
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
|
show 2 more comments
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
1
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
each $H_i$ is random from set of $2/(n+2)*2^N$ hashes, no? That's the whole point, it's the birthday problem, but reduced for each subsequent $H_i$.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
@Yanai Eliyahu: more precisely, for any fixed $i$, $H_i$ is random in a set of size typicaly less than $2^N$ and reducing with $i$, when the seed $S$ is uniformly random. $n$ does not come into play here. An approximation of the size of this set may be $2/(i+2)*2^N$ (depending on the particular $H$), but again since the actual $S$ is fixed, the size of that set is immaterial to the probability of collision among the $H_i$ with $0le i<n$
$endgroup$
– fgrieu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
you mean because there is only 1 string, there is no collision?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
$begingroup$
@Yanai Eliyahu: yes, I mean that since there is a single $S$, there is single $H_i$ for any given $i$, Thus no collision for a given $i$. If we had a magic box that performs $i$ iterated hashes in a blink, and we used that box for many $S$, then the size of the set of the possible $H_i$ would matter. But no magic box in sight.
$endgroup$
– fgrieu
8 hours ago
1
1
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
Got it... it makes sense now, I tested that attack on fixed $S$, and it worked like normal birthday problem, but when I only used $H_0$ and $H_1$ and made many strings it worked as expected (improved collision chance), but reaching higher $M$ reduces the collision chance to the birthday problem.
$endgroup$
– Yanai Eliyahu
8 hours ago
|
show 2 more comments
$begingroup$
Let $M$ be the number of queries to a uniform random function $F$ at distinct points $X_1, X_2, dots, X_M$. The probability of a repeated value $F(X_i) = F(X_j)$ for $i ne j$ is at most $M^2!big/2^N$ by the birthday paradox. For $M = 2^N/3$, this is $2^2N/3!big/2^N = 1big/2^N - 2N/3 = 1big/2^N/3$. If your calculation doesn't fit this bound, there's an error in your calculation.
‘But what if we come upon a short cycle in $H mapsto F(S mathbin| H)$?’, you ask. The expected cycle length of a uniform random function is $frac12sqrt2pi,2^N approx 2^N/2$ (Harris 1960 Eqs. 3.2, 3.4, 3.11; paywall-free), so no, this method doesn't improve the expected cost.
Using a clever tortoise-chasing-hare algorithm to find a cycle, rather than making a big table and checking for duplicates, may reduce the memory or area*time cost of an attack, as in the van Oorschot–Wiener parallel collision search machine, but it doesn't escape the birthday bound!
$endgroup$
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
$begingroup$
Let $M$ be the number of queries to a uniform random function $F$ at distinct points $X_1, X_2, dots, X_M$. The probability of a repeated value $F(X_i) = F(X_j)$ for $i ne j$ is at most $M^2!big/2^N$ by the birthday paradox. For $M = 2^N/3$, this is $2^2N/3!big/2^N = 1big/2^N - 2N/3 = 1big/2^N/3$. If your calculation doesn't fit this bound, there's an error in your calculation.
‘But what if we come upon a short cycle in $H mapsto F(S mathbin| H)$?’, you ask. The expected cycle length of a uniform random function is $frac12sqrt2pi,2^N approx 2^N/2$ (Harris 1960 Eqs. 3.2, 3.4, 3.11; paywall-free), so no, this method doesn't improve the expected cost.
Using a clever tortoise-chasing-hare algorithm to find a cycle, rather than making a big table and checking for duplicates, may reduce the memory or area*time cost of an attack, as in the van Oorschot–Wiener parallel collision search machine, but it doesn't escape the birthday bound!
$endgroup$
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
$begingroup$
Let $M$ be the number of queries to a uniform random function $F$ at distinct points $X_1, X_2, dots, X_M$. The probability of a repeated value $F(X_i) = F(X_j)$ for $i ne j$ is at most $M^2!big/2^N$ by the birthday paradox. For $M = 2^N/3$, this is $2^2N/3!big/2^N = 1big/2^N - 2N/3 = 1big/2^N/3$. If your calculation doesn't fit this bound, there's an error in your calculation.
‘But what if we come upon a short cycle in $H mapsto F(S mathbin| H)$?’, you ask. The expected cycle length of a uniform random function is $frac12sqrt2pi,2^N approx 2^N/2$ (Harris 1960 Eqs. 3.2, 3.4, 3.11; paywall-free), so no, this method doesn't improve the expected cost.
Using a clever tortoise-chasing-hare algorithm to find a cycle, rather than making a big table and checking for duplicates, may reduce the memory or area*time cost of an attack, as in the van Oorschot–Wiener parallel collision search machine, but it doesn't escape the birthday bound!
$endgroup$
Let $M$ be the number of queries to a uniform random function $F$ at distinct points $X_1, X_2, dots, X_M$. The probability of a repeated value $F(X_i) = F(X_j)$ for $i ne j$ is at most $M^2!big/2^N$ by the birthday paradox. For $M = 2^N/3$, this is $2^2N/3!big/2^N = 1big/2^N - 2N/3 = 1big/2^N/3$. If your calculation doesn't fit this bound, there's an error in your calculation.
‘But what if we come upon a short cycle in $H mapsto F(S mathbin| H)$?’, you ask. The expected cycle length of a uniform random function is $frac12sqrt2pi,2^N approx 2^N/2$ (Harris 1960 Eqs. 3.2, 3.4, 3.11; paywall-free), so no, this method doesn't improve the expected cost.
Using a clever tortoise-chasing-hare algorithm to find a cycle, rather than making a big table and checking for duplicates, may reduce the memory or area*time cost of an attack, as in the van Oorschot–Wiener parallel collision search machine, but it doesn't escape the birthday bound!
answered 6 hours ago
Squeamish OssifrageSqueamish Ossifrage
31.1k1 gold badge52 silver badges133 bronze badges
31.1k1 gold badge52 silver badges133 bronze badges
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
+1 for the classical reference to Harris, and a softcopy, which already has most of the results in later papers by crypto experts...
$endgroup$
– kodlu
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
$begingroup$
I feel like Harris's paper answers about a quarter of all the questions on this site!
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
Yanai Eliyahu is a new contributor. Be nice, and check out our Code of Conduct.
Yanai Eliyahu is a new contributor. Be nice, and check out our Code of Conduct.
Yanai Eliyahu is a new contributor. Be nice, and check out our Code of Conduct.
Yanai Eliyahu is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f72850%2fwhy-this-brute-force-attack-doesnt-reduce-all-cryptographic-hash-functions-sec%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
$begingroup$
Welcome to Cryptography. Could you elaborate
The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes.
$endgroup$
– kelalaka
9 hours ago
$begingroup$
@kelalaka The sentence after that meant to support that statement, is it out of place?
$endgroup$
– Yanai Eliyahu
8 hours ago
$begingroup$
@kelalaka I didn't get the first 2 sentences. This is the same birthday attack just that the possible hashes are decaying overtime, so security is reduced.
$endgroup$
– Yanai Eliyahu
8 hours ago