I've seen some mentions of a "SHA-256/192" online. Clearly, this means the output of SHA-256 is truncated to 192 bits, but does it also use different Initial Values like SHA-512/256?
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
No, it is just the truncated as mentioned in NIST SP 800-208
$\operatorname{SHA-256/192}(M)$
$T_{192}(\operatorname{SHA-256}(M))$, the most significant (i.e., leftmost) 192 bits of the SHA-256 hash of M.
Where $T$ stands for the truncation.
This is specific to $\operatorname{SHA-256/192}(M)$. The other truncated version specified in FIPS PUB 180-4 uses different Initial Values for domain separation. See more detail in this answer;
Note that although it is pointed out by Poncho that the domain separation is not important in the context of SP 800-208, when you start to use it out of the context, you may be open to attacks. Always be careful!
answered Sep 12, 2022 at 22:59
-
5$\begingroup$ The reason that 800-208 defines SHA-256/192 is so that it can be implemented even if you have access only to a nonadjustable SHA-256 implementation (and because domain separation is unimportant in this use case) $\endgroup$– ponchoCommented Sep 13, 2022 at 3:43
-
1$\begingroup$ @poncho I've found this decision interesting. Changing the IVs from implementation is not hard as long as the implementation is not a hardware implementation. $\endgroup$– kelalakaCommented Sep 13, 2022 at 10:24
-
2$\begingroup$ Not necessarily, if the software implementation doesn't give access to its internal state (e.g. it uses an abstract 'context' to hold intermediate results, rather than having a structure that the application can tweak), you couldn't arbitrarily set the initial state. If I recall correctly (it's been a long time) I believe the old BSAFE API had these limitations (and so it's not just speculation; it has actually happened) $\endgroup$– ponchoCommented Sep 13, 2022 at 12:48
-
$\begingroup$ @poncho yes, companies can restrict in with the API. Nice to know another. $\endgroup$– kelalakaCommented Sep 13, 2022 at 20:17
-
1$\begingroup$ I'd argue that the restriction is in place in most libraries for higher level languages and probably even lower level languages. It is easy to do when creating the library, but not easy if you're just using an object representing the algorithm. $\endgroup$– Maarten Bodewes ♦Commented Sep 14, 2022 at 7:04