Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I hash a keyword with SHA-512 and then feed the output as the key for the next round ....and keep repeating this process, will I gather a stream of random numbers?

share|improve this question
pseudorandom yes, depending on your use of the outputs, the method you described may be a massive security risk – Richie Frame Apr 9 '14 at 8:38
1… describes some of the problems you may run into with schemes like this. – archie Apr 9 '14 at 9:07

For an adversary not knowing the definition of SHA-512 (or just not knowing the 512-bit initialization constant of SHA-512, defined as the first sixty-four bits of the fractional parts of the square roots of the first eight prime numbers), the sequence obtained by $$\begin{align*} H_0&=\text{SHA-512}(Seed){\small\text{ where }}Seed{\small\text{ is the statement's keyword}}\\ H_{i+1}&=\text{SHA-512}(H_i)\\ \end{align*}$$ is a Cryptographically Secure Pseudo-Random Number Generator as far as we know. It is in practice indistinguishable from random for said adversary, with residual odds of the contrary less than $2^{-100}$, assuming a few additional requirements:

  1. Less than $2^{200}$ outputs are available to the adversary [rationale: if it happens that the generator enters a cycle, then the adversary can predict future output, including with feasibly little memory; after about $2^{(512-100+1)/2}$ iterations of a random function with 512-bit output, odds of cycling are about $2^{-100}$; I kept some margin]. Notice that producing even the first $2^{60}$ outputs would take at least five years with current technology, because this RNG and SHA-512 are a serial process [estimate based on two gate delays each one picosecond per round].
  2. This adversary uses classical computing means bound to perform less work than needed for $2^{250}$ hash computations (a safe assumption), or anything that I can fantasize today (your call) [rationale: the best explicit attack I have enumerates the SHA-512 initialization values, and that reaches odds $2^{-100}$ to succeed at about $2^{412}$ hashes; I kept a helluva of margin]; Note: 1 and 2 can be combined into the adversary can not perform the classical-computing equivalent of counting to $2^{200}$, which is still very credible.
  3. $Seed$ is never reused.
  4. The adversary does not obtain the SHA-512 specification (including initialization value) by some oblique mean: reverse engineering, operating goof, spying (including bribery and planting trojans), rubber hose cryptanalysis, side channels.. [Note: reading the official specification was discounted in the first sentence].

However, with respect to an adversary knowing the full definition of SHA-512 (which is the assumption a cryptographer will make by Kerckhoffs's principles), the generator is unsafe. In particular, $H_j$ for $j>i$ can be trivially predicted from $H_i$; the generator fails the next bit test.

In addition, from a practical perspective, the generator is very bad by the mere fact that it is simultaneously

  • deterministic;
  • without another key than a keyword presumably of low entropy;
  • without provision for key streching to slow keyword enumeration.

If the keyword is simple enough to be reliably memorized in a real application by a majority of adult humans, then password cracking can quickly find the keyword by enumeration knowing say 10 bytes of $H_0$.

So all in all, the generator is secure for some non-cryptographic applications like numerical simulations, and disastrous from the perspectives on-topic here.

share|improve this answer

The definition of "random" is something not very clear that deserves some more explanation, like what you expect from the output number sequence.

  • If you want an uniformed distributed sequence you will get it.

  • If you want an unpredictable sequence you won't.

  • If you want a "sequence undistinguishable from random" you won't get it either.

share|improve this answer
Strictly speaking, the sequence is not uniformly distributed: it will ultimately enter a cycle (that's expected after roughly $2^{256}$ hashes), and it is extremely unlikely that the mean number of $1$ in this cycle is exactly $1/2$, a requirement for any uniformly distributed ultimately cyclic sequence. – fgrieu Apr 9 '14 at 9:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.