Return to Answer

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file) then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made.

If plaintext can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H that SHA-256 may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file) then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made. For some level of protection against that, use a Password-Based Key Derivation Function such as PBKDF2, or better scrypt.

If plaintext can't be guessed (e.g has 128 bits of entropy), then no: root and plaintext will not leak, from a practical standpoint. More precisely, we are safe, for some strong enough hypothesis on H, that SHA-256 may meet (and meets in practice as far as we know).. or perhaps not (since we have no proof). A suitable hypothesis on H is being computationally indistinguishable from a random function (aside from the length-extension property, and being a particular public function). As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file, then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made.

If plaintext can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H that SHA-256 may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file) then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made.

If plaintext can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H that SHA-256 may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file, then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made.

If plaintext can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H that SHA-256 may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file, then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made.

If plaintext can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H that SHA-256 may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )