Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash.

Should I take the first bits or the last bits? Which of them contain the most entropy?

share|improve this question
up vote 24 down vote accepted

If taking the first or last bits of a SHA-256 output made any difference, it would be viewed as a serious blow against the security of SHA-256. Right now, no such weakness is known in SHA-256. So, as far as we know, you can use whatever bits you want.

If you need a more "administrative" answer, have a look at SHA-224 (also specified in FIPS 180-3). This is a hash function with a 224-bit output, which NIST defined in order to "match" (administratively speaking) the proclaimed 112-bit security of 3DES. They defined SHA-224 by taking SHA-256, changing the conventional IV, and truncating the output. For the truncation, they took the first 224 bits. If it is good for NIST then it is good for you: take the first bits.

share|improve this answer
They only claimed that the first bits were strong right?… In fact, using the last bits would be detrimental to security no? – Pacerier Jul 9 '12 at 19:33
@Pacerier - No. There is no reason to believe that using the last bits would be detrimental to security (and there are very strong reasons to expect that it is not detrimental). You're misreading the contents of that link. – D.W. Oct 23 '13 at 6:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.