Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have been told that one advantage of using a hash function is that it spreads entropy over all input bits. But it also seems to be true that a bad hash algorithm can make things less random. But how do I know if the hash I am using doesn’t make things less random?

Currently, I’m hashing (SHA2) a few extracted bytes I collect from a CSRNG to create keys for AES encryption/decryption. Is that wrong? From what I’ve been reading, SHA2 seems to be secure. But I could also skip SHA2 and extract more random bytes from the CSRNG until I’ve got enough bytes for a key. Is that a better idea? Or is SHA2 not one of those hashes that might make things less random?

share|improve this question
add comment

1 Answer 1

up vote 5 down vote accepted

Currently, I’m hashing (SHA2) a few extracted bytes I collect from a CSRNG to create keys for AES encryption/decryption. Is that wrong?

Depends on what you mean by "a few"; if you mean 16 or more, then yes, that is likely to be secure. However, if you mean, say, 4, then that is Very Bad.

The reason is that the hash function doesn't do magic; if you use only 4 bytes of CSRNG output, and then compute:

$$Key := SHA256( \text{CSRNG Output} )$$

then what an attacker can do is exhaustive search over all 4 bytes of possible CSRNG output, compute the corresponding keys, and test them; there are only $2^{32}$ possibilities; a single laptop is likely to be able to go through all of them in perhaps an hour.

But I could also skip SHA2 and extract more random bytes from the CSRNG until I’ve got enough bytes for a key. Is that a better idea?

Well, you'll likely need that many bytes of CSRNG output to form a secure AES key anyways; once you have that many, the SHA256 doesn't add anything.

Or is SHA2 not one of those hashes that might make things less random?

No, SHA2 is not likely to be a weak hash function. However, the problem is that SHA2 doesn't make things more random -- if there are only $2^{32}$ possible inputs to SHA2, there are only $2^{32}$ possible outputs. It might make things look more random, but that's not what we care about.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.