Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!newsfeed.xs4all.nl!newsfeed1.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Date: Wed, 23 Jan 2013 19:09:52 -0500
From: Dave Angel <d@davea.name>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130106 Thunderbird/17.0.2
MIME-Version: 1.0
To: python-list@python.org
Subject: Re: Uniquely identifying each & every html template
References: <8deb6f5d-ff10-4b36-bdd6-36f9eed58e1e@googlegroups.com> <5dd4babd-716d-4542-ad36-e6a841b73ec3@googlegroups.com> <mailman.684.1358586035.2939.python-list@python.org> <03581a24-9330-4019-bde9-61a607000d3d@googlegroups.com> <mailman.729.1358752818.2939.python-list@python.org> <187d77e0-e948-46bf-acc5-668c446cf3aa@googlegroups.com> <mailman.733.1358760692.2939.python-list@python.org> <239abe33-fa5b-41a9-ae80-5260b9b1bd9c@googlegroups.com> <CAHVvXxRGXiSAnzGqra5Rek47peYXzTscB8-Xj-UAxyurDqVgpA@mail.gmail.com> <mailman.743.1358772477.2939.python-list@python.org> <e5a1d698-bf58-46af-8295-ba2d1c277558@googlegroups.com> <mailman.844.1358898919.2939.python-list@python.org> <2391171e-e170-4647-8924-8e446ea1c6b1@googlegroups.com> <9d9b287c-ca2a-49c1-a16b-e42cb2a5db38@q16g2000pbt.googlegroups.com> <6f3e7d20-3005-4d1e-b949-d90a78e7bbf6@googlegroups.com> <50FFD9B8.3090304@davea.name> <CAPTjJmpp9uJDz2qTf4sAKBj12dF7g=tJKDFDW4_1jh7RJcNs-Q@mail.gmail.com>
In-Reply-To: <CAPTjJmpp9uJDz2qTf4sAKBj12dF7g=tJKDFDW4_1jh7RJcNs-Q@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.935.1358986212.2939.python-list@python.org>
Lines: 51
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:37522

On 01/23/2013 06:25 PM, Chris Angelico wrote:
> On Wed, Jan 23, 2013 at 11:38 PM, Dave Angel <d@davea.name> wrote:
>> You think it's an accident that md5 size is roughly equivalent to 39 decimal
>> digits?  Or that the ones that haven't been proven insecure are much larger
>> than that?  The sha512 hash is roughly equivalent to 154 decimal digits.
>
> Proving a hash function secure or not is orthogonal to its length. You
> could have a cryptographically secure hash function that produces a
> single byte; you'd get collisions pretty often, but that's understood.
> Conversely, you could have an insecure hash that produces a value
> several orders of magnitude longer than SHA512. Look at this:
>
> def big_long_hash(val):
>      return sum(bytes(str(val),"utf-8"))*12345678901234567890
>
> But longer hashes do reduce the chance of collisions, by the
> fundamental rules of mathematics.
>

I certainly can't disagree that it's easy to produce a very long hash 
that isn't at all secure.  But I would disagree that longer hashes 
*automatically* reduce chances of collision.

Anyway, about cryptographically ...

OK, I'd like to learn here.  I thought that "cryptographically secure" 
meant that it was infeasible to take a given message and make an 
innocuous change to it (such as adding a trailer of whatever size) and 
from that produce a predetermined hash value.

Obviously "infeasible" will change over time.  But if my definition is 
even close, then wouldn't it be a necessary (not sufficient) condition 
that the hash be at least some certain size.  It is that size I was 
trying to impress on the OP.

Wikipedia - http://en.wikipedia.org/wiki/Cryptographic_hash_function

seems to say that there are four requirements.
it is easy to compute the hash value for any given message
it is infeasible to generate a message that has a given hash
it is infeasible to modify a message without changing the hash
it is infeasible to find two different messages with the same hash


Seems to me a small hash wouldn't be able to meet the last 3 conditions.




-- 
DaveA