Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what does it mean by "hash context"? Secondly, which "data" is it referring to? Is that paragraph still talking about what to do if the hash is too small?

Simple S2K

This directly hashes the string to produce the key data. See below for how this hashing is done.

   Octet 0:        0x00
   Octet 1:        hash algorithm

Simple S2K hashes the passphrase to produce the session key. The
manner in which this is done depends on the size of the session key
(which will depend on the cipher used) and the size of the hash algorithm's output.

If the hash size is greater than the session key size, the high-order (leftmost) octets of the hash are used as the key.

If the hash size is less than the key size, multiple instances of the hash context are created -- enough to produce the required key data. These instances are preloaded with 0, 1, 2, ... octets of zeros (that is to say, the first instance has no preloading, the second gets preloaded with 1 octet of zero, the third is preloaded with two octets of zeros, and so forth).

As the data is hashed, it is given independently to each hash context. Since the contexts have been initialized differently, they will each produce different hash output. Once the passphrase is hashed, the output data from the multiple hashes is concatenated, first hash leftmost, to produce the key data, with any excess octets on the right discarded.

share|improve this question

1 Answer 1

Yes, it's still talking about the case where multiple hashes are needed to get to the key size. It explains that they are taken independently (different contexts) over the passphrase (the data).

For example, with a 160-bit hash (e.g. SHA-1) and a 256-bit key, you would concatenate $H(p)||H(0x00||p)$, then take the leftmost 256 bits (i.e. discard the rightmost 8 octets).

If you needed one more hash block, that would be $H(0x00||0x00||p)$, etc..

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.