In a single round of SHA-512, in the operations $\Sigma_0(A)$, $\Sigma_1(E)$ why are the constants $28$, $34$, and $39$ used for the number of rotations? What significance do these numbers have? What if they are changed?
migrated from security.stackexchange.com Jun 8 at 19:27
This question came from our site for Information security professionals.
The SHA-2 family is built from a block cipher in a Davies-Meyer construction, where the message is considered they key, and the current hash value the plaintext. The 2nd set of constants in the SHA-512 round function is 14, 18, and 41. Rotations are also performed in the message expansion (key schedule), and are also important.
The block cipher at the center of the compression function must behave in a secure manner, and the rotational constants were chosen in such a way that the block cipher is resistant to standard cryptographic attacks. The round count was then fixed to meet the security requirement of the hash digest, plus some wiggle room for new attacks.
SHA-2 was developed in secret at the NSA, so the above is partly speculative, however we do have good examples of how improper choice of rotational constants can weaken a hash function. During the SHA-3 competition, the Skein hash function was successfully attacked using rotational cryptanalysis, and a change in the rotational constants was made to prevent the attack. The attack with the old rotational constants was 22 rounds more effective than the best attack on Skein with the new constants; that is 30% of the full round count, which is substantial.
The attack seemed to exploit the specific combination of rotations and modular addition, both of which are heavily used in the SHA-2 compression functions. The continued lack of highly effective attacks on SHA-2 implies that its rotational constants were chosen well. The way that rotations are used in SHA-2 and Skein differ, but poor constants would still have prevented proper diffusion within the round, or in the key schedule. The best attacks are still reduced round differential and biclique attacks, and are not practical.