Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that?

Links:

share|improve this question
    
If you really need a cryptographic hash function with a large output you could try Skein-1024. It has the added advantage of not being designed by NSA. –  NDF1 Aug 21 at 4:44

2 Answers 2

up vote 4 down vote accepted

The Secure Hash Standard and corresponding FIPS-180/202 do not specify any hash to meet a security requirement above 256-bits (using a 512-bit hash). This is unlikely to change.

SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general purpose registers. This meant that the state was built with 8-words to meet the 2 most common security requirements.

Support of a larger digest would either require the core compression function to be different (as there would need to be more word inputs) or a larger word size, which did not exist (and still does not) except in specialized processors or SIMD registers (without appropriate instructions). The combination of no need and no can do meant there was no design of a 1024-bit state SHA-2 hash function.

Sponge functions on the other hand allow security to be determined by a combination of sponge capacity and output length. Keccak supports an internal security level up to almost 800-bits, but at a substantial performance hit. SHA-3 is built from Keccak.

While SHA-3 does not specify a hash with security above 256-bits, it does specify an extendable output function SHAKE256, which is a function with variable length outputs at a 256-bit internal security. SHAKE256-1024 would be a 1024-bit digest with the effective security of a 512-bit hash.

share|improve this answer

No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.)

If you think large quantum computers will be efficient, a 512-bit hash makes some sense, but even then a 1024-bit one wouldn't. A quantum computer requires $O(2^{n/3})$ operations to find break the collision resistance of a secure $n$-bit hash.

Finally, SHA-256 uses 32-bit words and SHA-512 64-bit. If you wanted to use the same way to extend SHA to 1024-bit state, you would need to use 128-bit operations which are slow on practically all platforms.

share|improve this answer
1  
I'd like to note that from a (perhaps uninformed) prespective, the fact that it's slow on current platforms doesn't provide extra security. It simply provides an easy avenue for an attacker to amass a large amount of password-bruteforcing power with a custom device that supports 128-bit operations. –  hexafraction Aug 19 at 0:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.