2
$\begingroup$

I was reading about hash functions, namely SHA, and I read that it is made of the Merkle-Damgård construction. And then the text said that the compression function used is based on the Davis-Meyer compression function. The text also mentioned that SHA-256 is based on the block cipher SHACAL-2.

I got a little bit confused about the building block that constitutes SHA-256. Is SHACAL-2 a block cipher or a compression function or both? And what are the advantages of using SHACAL-2 instead of AES-128?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
6
$\begingroup$

SHACAL-2 is a block cipher. One way compression functions are typically using block ciphers as a building block, but add some simple operation that make the function one way. In the case of SHA-256, the compression function is SHACAL-2 in Davies-Meyer mode. SHA-256 in turn, consists of this compression function with Merkle-Damgård padding and chaining.

Regarding your last question, SHACAL-2 has a 256 bit block size. This means that it is practically impossible that you would get a state collision by pure chance, when using the cipher in any of the common modes of operations. AES has a 128 bit block size, so the risk of a state collision might in some cases be too high for comfort, when encrypting very large quantities of data using the same symmetric key.

Improve this answer
$\endgroup$
5
  • $\begingroup$ So the SHACAL-2 can also be used as a regular block cipher for encryption? $\endgroup$
    – BlaX
    Commented Aug 10, 2014 at 22:40
  • $\begingroup$ Yes, SHACAL-2 was e.g. selected as part of the NESSIE portfolio. However, it should be noted that some standard modes of operation don't have a 256-bit equivalent, such as GCM. $\endgroup$
    – Henrick Hellström
    Commented Aug 11, 2014 at 6:35
  • 4
    $\begingroup$ Very good answer. There are two additional advantages of SHACAL-2, I would like to highlight: First: On small microprocessors it could be desirable to implement just one function. It is easy to implement just SHACAL-2 and use it for hash and block cipher. Secondly: On some platforms it is hard to implement AES efficiently without timing side channel. SHACAL-2, on the other hand, is commonly easy to implement without timing side channel. $\endgroup$
    – user4982
    Commented Aug 12, 2014 at 16:59
  • $\begingroup$ In the first answer, it is explained that SHACAL-2 is a block cipher that is using Devies Meyer mode in order to make it non-reversible. So, in this case, when it is used to implement SHA-256, the massage block (call it m) is used as the key or as the plain text? $\endgroup$
    – Evgeni Vaknin
    Commented Apr 24, 2015 at 16:15
  • $\begingroup$ @EvgeniVaknin The message is used as the key, the current state is used as the input data. This is the Davies-Meyer mode. Hence block ciphers used in this mode need to be especially secure against related-key attacks, as the attacker chooses the keys. $\endgroup$
    – Henno Brandsma
    Commented Jan 10, 2019 at 15:20
0
$\begingroup$

I looked more into it and saw that the state input is the data input of the block cipher and the data (that is being hashed) is the key input to the underlying block cipher (SHACAL). Thanks anyway.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.