# Safety when disclosing hashes of secrets used to calculate other secrets

In my application, I am generating a big random number and publishing a SHA256 hash of it. After the hash it published (but not the secret), anyone can submit any number, and the system will calculate and present them a SHA256 hash of the number derived by concatenating their number at the end of the secret number from my system (SHA256(A+B)). The result of that operation should not be guessable without the secret number.

I am wondering if there are any security concerns with this approach that I should be weary about, such as if the random number is of certain length, would that make the result guessable? Or is this approach cryptographically safe?

-
What's the security goal of the overall scheme? In particular, if it's to prevent anyone else from later pretending to have known the secret before you published it, how do you plan to stop a potential pretender from simply relaying all queries to you? –  Ilmari Karonen Oct 20 '13 at 13:12
@IlmariKaronen To prevent anyone from knowing a result of a hash for particular input before they query the system. In other words, as long as the secret is not known, the result of SHA256(A+B) for non-empty B should be unknowable before someone sends a query with B to the system. –  ThePiachu Oct 20 '13 at 19:33
That's not really a goal in the sense I meant -- it's, at best, the means of reaching some goal that you haven't told us. But fair enough -- if that's all you need, then Ricky's suggestion of using HMAC should do fine. –  Ilmari Karonen Oct 21 '13 at 16:33
@IlmariKaronen At the moment I can't disclose what is the practical application of this, but the technical side of it is generating hashes of a secret number and a given number that are unknown before the operation takes place despite the hash of the secret number being known. –  ThePiachu Oct 22 '13 at 1:45

(Also, $\:$ SHA256(A+"") = SHA256(A)$\:$.)