Here are some illustrated explanations of the main ways in which cryptographic hash functions can be attacked, and be resistant to those attacks.
Zooko Wilcox's blog post Lessons From The History Of Attacks On Secure Hash Functions gives us a nice overview of these and I've quoted his concise explanations below. Check out his great post for more detail and history on this topic.
A cryptographic hash function is an important building block in the cryptographic systems that keep us safe in our communications on the internet.
A hash function takes some input data and generates a hopefully unique string of bits for each different input. The same input always generates the same result.
The input to a secure hash function is called the pre-image and the output is called the image.
I use the following key below:
Red for inputs which can be varied by an attacker.
Green for inputs which can't be varied under the attack model.
To attack a hash function the variable inputs are generally iterated on in a random or semi-random brute-force manner.
A hash function collision is two different inputs (pre-images) which result in the same output. A hash function is collision-resistant if an adversary can't find any collision.
A hash function is pre-image resistant if, given an output (image), an adversary can't find any input (pre-image) which results in that output.
A hash function is second-pre-image resistant if, given one pre-image, an adversary can't find any other pre-image which results in the same image.
Hopefully these diagrams help to clarify how these attacks work!
Read more of my posts on the subject of cryptography.
Last night I gave a talk at a Perth Linux User's Group meetup about
doing Linuxy stuff on small machines:
Frock is a little experimental tool for writing PHP scripts using Clojure-like LISP syntax.
If you want to see what the code looks like, here's an example which fetches and lists top news items from the Hacker News API.
Frock could be interesting to you if you are LISP or Clojure programmer writing a web application which is mostly front-end code, but which needs some small amount of server side logic for e.g. proxying, authentication, data persistence etc. and you want this application to be easily deployable by semi-technical users on commodity hosting.
Basically if your target audience is graphic designers, you like Clojure, and your backend requirements are slim, then you might be interested.
PHP is an old server-side web development language which is simultaneously loathed by software developers everywhere, and also wildly popular and widely deployed. To reconcile this paradox let's take a look at some pros and cons of PHP.
- Ugly language semantics & features.
- Dubious security record.
- Much awful legacy code lying around.
- User-friendly app deployments (simply copy files to server).
- Widely available on internet servers.
- Mature language and ecosystem.
- Excellent documentation.
- Much useful tech bundled ("batteries included").
The pros make PHP quite democratic. It's very easy to install PHP code on widely available, cheap, commodity hosting. It's easy to get started writing PHP applications; the PHP binary comes pre-installed on OSX for example. PHP contains a lot of capabilities by default: zipping files, opening sockets, encryption, command execution.
Frock exists to make the language semantics and features less of a con for brace wrangling LISP heads, whilst retaining the wide deployment surface and other democratic features of PHP.