Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading about hash functions, namely SHA, and I read that it is made of the Merkle-Damgard construction. And then the text said that the compression function used is based on the Davis-Meyer compression function. The text also mentioned that SHA-256 is based on the block cipher SHACAL-2.

I got a little bit confused about the building block that constitutes SHA-256. Is SHACAL-2 a block cipher or a compression function or both? And what are the advantages of using SHACAL-2 instead of AES-128?

share|improve this question
up vote 6 down vote accepted

SHACAL-2 is a block cipher. One way compression functions are typically using block ciphers as a building block, but add some simple operation that make the function one way. In the case of SHA-256, the compression function is SHACAL-2 in Davies-Meyer mode. SHA-256 in turn, consists of this compression function with Merkle-Damgård padding and chaining.

Regarding your last question, SHACAL-2 has a 256 bit block size. This means that it is practically impossible that you would get a state collision by pure chance, when using the cipher in any of the common modes of operations. AES has a 128 bit block size, so the risk of a state collision might in some cases be too high for comfort, when encrypting very large quantities of data using the same symmetric key.

share|improve this answer
So the SHACAL-2 can also be used as a regular block cipher for encryption? – BlaX Aug 10 '14 at 22:40
Yes, SHACAL-2 was e.g. selected as part of the NESSIE portfolio. However, it should be noted that some standard modes of operation don't have a 256-bit equivalent, such as GCM. – Henrick Hellström Aug 11 '14 at 6:35
Very good answer. There are two additional advantages of SHACAL-2, I would like to highlight: First: On small microprocessors it could be desirable to implement just one function. It is easy to implement just SHACAL-2 and use it for hash and block cipher. Secondly: On some platforms it is hard to implement AES efficiently without timing side channel. SHACAL-2, on the other hand, is commonly easy to implement without timing side channel. – user4982 Aug 12 '14 at 16:59
In the first answer, it is explained that SHACAL-2 is a block cipher that is using Devies Meyer mode in order to make it non-reversible. So, in this case, when it is used to implement SHA-256, the massage block (call it m) is used as the key or as the plain text? – Evgeni Vaknin Apr 24 '15 at 16:15

I looked more into it and saw that the state input is the data input of the block cipher and the data (that is being hashed) is the key input to the underlying block cipher (SHACAL). Thanks anyway.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.