hash attacks and hashcash (SHA1 partial preimage of 0^160)

2004-08-18 Thread Adam Back
(This discussion from hashcash list is Cc'd to cryptography and cypherpunks.) Hashcash uses SHA1 and computes a partial pre-image of the all 0bit string (0^160). Following is a discussion of what the recent results from Joux, Wang et al, and Biham et al on SHA0, MD5, SHA1 etc might imply for hash

Re: SHA-1 status, plus request for explanation...

2004-08-18 Thread Greg Rose
At 12:00 2004-08-18 -0400, Perry E. Metzger wrote: Biham & Chen can find collisions in a reduced round version of SHA-1, but am I correct in saying that no one has found collisions in the full SHA-1 at this point? Correct, and at the end of his full talk this morning Eli said "we're not close to b

snakeoil of the day

2004-08-18 Thread Perry E. Metzger
http://serbianc.sourceforge.net/projects/fEncH Quoting the project page This is a fast and simple, yet hard to crack encryption program. It uses XOR encryption with variable key, based on the password that user inputs to the program I read the code quickly -- it is a simple repeated XO

Re: MD5 collisions?

2004-08-18 Thread Tim Dierks
On Thu, 19 Aug 2004 00:49:17 +1000, Greg Rose <[EMAIL PROTECTED]> wrote: > > It seems to be a straightforward differential cryptanalysis attack, so > > one wonders why no-one else came up with it. > > With further hindsight, and Phil Hawkes' help, I understand now. The > technique needs to alterna

RE: MD5 collisions?

2004-08-18 Thread Greg Rose
At 12:04 2004-08-18 -0400, Whyte, William wrote: > There has been criticism about the Wang et. al paper that "it doesn't > explain how they get the collisions". That isn't right. Note that from the > incorrect paper to the corrected one, the "delta" values didn't change. > Basically, if you throw r

Re: MD5 collisions?

2004-08-18 Thread Greg Rose
At 00:49 2004-08-19 +1000, Greg Rose wrote: There has been criticism about the Wang et. al paper that "it doesn't explain how they get the collisions". That isn't right. Note that from the incorrect paper to the corrected one, the "delta" values didn't change. Basically, if you throw random numb

RE: MD5 collisions?

2004-08-18 Thread Whyte, William
> There has been criticism about the Wang et. al paper that "it doesn't > explain how they get the collisions". That isn't right. Note that from the > incorrect paper to the corrected one, the "delta" values didn't change. > Basically, if you throw random numbers in as inputs, in pairs with the

SHA-1 status, plus request for explanation...

2004-08-18 Thread Perry E. Metzger
One more question about the results at Crypto... Biham & Chen can find collisions in a reduced round version of SHA-1, but am I correct in saying that no one has found collisions in the full SHA-1 at this point? And would anyone like to take a crack at explaining the work by Wang, Feng, Lai and

Re: RPOW - Reusable Proofs of Work

2004-08-18 Thread bear
On Tue, 17 Aug 2004, Hal Finney wrote: >A couple of quick responses to the questions on RPOW, as I am at >Crypto this week. I'm wondering how applicable RPOW is. Generally speaking, all the practical applications I can think of for a proof-of-work are defeated if proofs-of-work are storable, t

Re: MD5 collisions?

2004-08-18 Thread Greg Rose
In the light of day and less inebriated, I'd like to clarify some of what I wrote last night, and maybe expand a bit. My original account wasn't what I'd like to think of as a record for posterity. Greg. At 13:11 2004-08-18 +1000, Greg Rose wrote: Xiaoyun Wang was almost unintelligible. This was

Re: HMAC?

2004-08-18 Thread Peter Gutmann
[EMAIL PROTECTED] ("Hal Finney") writes: >The initial paper from Wang eg al announcing the results is unusual in that >it merely exhibits the collisions, while providing no information whatsoever >about how they were obtained. Perhaps they've managed to reduce RFC 3607 to practice :-). Peter. -