Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (i.e. a random salt)? Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value.

share|improve this question
    
"Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value." Not quite, the appended message length would be off by a few bytes. –  Thomas Oct 3 '12 at 13:45
    
i.e. ≠ e.g. ... –  Tobias Kienzler Dec 5 '13 at 8:56
add comment

1 Answer 1

up vote 7 down vote accepted

With the message padding scheme of SHA-2/SHA-256 as it stands (add one 1 bit, a minimal number of 0 bits so that the overall padded message will end on a block boundary, then the original message length over some fixed number of bits), I know no attack enabled by allowing a different IV.

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.

share|improve this answer
    
Thanks. I need to read your answer a few times, but this was the kind of insight I was seeking. –  ericball Oct 3 '12 at 14:28
2  
@ericball If the answer was useful to you, please don't forget to accept the answer. ;) –  e-sushi Oct 18 '13 at 22:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.