Re: keys and counters

Antony Clements wrote:
"Stefan Pinzel" <stefan.pinzel@xxxxxxxxxxxxxxxxxxx>
No, since SHA256 is limited to 256 bits.

sha256 has 256 bit output, just like sha512 is a 512 bit output.

but that was not the question.

I think that was the question. From what you say below I think you did not phrase it very well.


if you have a string "hello world!" and append a counter and then hash it, how many times can the counter be incremented before there is a collision in the hash, that is what i am asking. it has nothing to do with the size of the hash output.

as Mr Rose pointed out that if the counter is transmitted in the clear, then the attacker can guess the key and recreate the hash, while it's possible, it's not exactly in the realms of feasable, neither your answer or his answer the two fundamental questions being asked..

question 1) if there is a counter of unlimited size that is incremented every time the key function is run, would each >unique< hash result constitute an OTP

No. A OTP has very specific requirements that might be summarised as each bit being totally unpredictable regardless of how many bits you know that were generated before or after the one you are guessing. A hash function operated in such a counter mode as you suggest does not have this property - if I can guess or discover the input to the first block then I will know all the other blocks.

You might think that some attacks are unreasonable/infeasible but do you really know what is possible to the world's largest employer of mathematicians, who have had for many years the world's largest computer budget and unlimited access to 60 plus years of classified research or what is possible for any of the other multi-billion dollar "smaller" big brothers?.

If you receive a valid answer that is not what you wanted, whose fault is that? More accurate questions and if needed, follow questions would be appropriate. Serious crypto has a serious standard because of the type of attacks and types of opponents possible. Recreational cryptography is different and if that is what you want you could join the ACA.


question 2) how many times can the counter be incremented before there is a collision in the sha256 output. ie producing the same output twice.


As a general guide, a collision is expected after approximately the square root of all possible outputs has been generated. In the sha256 case, after about 2**128 iterations you would expect a collision. After that collisions come much faster.

Also, 2**128 also represents the brute force approach - there may be algorithmic techniques that will get you there much sooner. An example of this happening is the 128 bit hash function MD4. At first MD4 was thought secure, even if wasn't very conservative. Collisions which should have taken 2**64 computations can now, in some cases, be done in ten minutes with a pen and pencil.


.

Relevant Pages

  • Re: SHA-1 and the "birthday paradox"
    ... risk of collision when using SHA-1 as a digest, or hash key, for ... identical SHA-1 digest referring to two distinct blocks rather than a ... If you find a collision on SHA-1 then you may publish it and become ... (Cost is here expressed in number of hash function computations which ...
    (comp.lang.forth)
  • Re: Maximum String size in Java?
    ... The hash function will *NOT* have the minimal collision ... > for long strings, so on average, SFH bakes it in the performance ...
    (comp.programming)
  • Re: Two-stage hashing (pre-hash big integer -> hash-array-index)
    ... > hash value instead of the key to generate the probe sequence. ... avoid all hashes with same home index following same collision chain, ... are the same will follow exactly the same collision chain. ... computes what I call the pre-hash, the large unsigned integer, from the ...
    (comp.programming)
  • Re: Panama hash collision question
    ... > No hash is literally collision free. ... We synchronize database systems by forming a checksum for each record ...
    (sci.crypt)
  • Re: Why do hashes have bigger keys than block ciphers?
    ... Does it have to do with preventing collision attacks? ... you have a 128 bit hash, you can generate a collision (two messages ... FWIW, the 1024 bit hashes seem a bit silly, but it probably doesn't ...
    (sci.crypt)