0
$\begingroup$

As we know, the IV and the output of SHA-256 are identical in size. Suppose the input value to the SHA-256 is completely transparent. Is there any correlation between IV value and output? Is it possible to limit the output space?

I would appreciate it if you can introduce any source - article or manuscript in this specific subject.

$\endgroup$
4
  • $\begingroup$ FIPS 180-4, which defines SHA-256, has examples of both limiting the output space (see SHA-224), and changing the IV to change the output for a given message. If that's not sufficient for some reason, please edit the question to make it more precise or/and state motivation. $\endgroup$
    – fgrieu
    Commented Jan 10, 2023 at 11:48
  • $\begingroup$ so you mean for a given message , it is possible to limite the output space using some limitations on the IV?OK? $\endgroup$
    – abbas
    Commented Jan 10, 2023 at 12:02
  • $\begingroup$ but as I know it is not possible and I am trying to find some new attacks $\endgroup$
    – abbas
    Commented Jan 10, 2023 at 12:11
  • $\begingroup$ The IV is the inner hash value. It necessarily has the size of the inner state. If you want to find some attacks, you first need to know the details of the hash function. $\endgroup$
    – Maarten Bodewes
    Commented Jan 10, 2023 at 12:20

1 Answer 1

3
$\begingroup$

As we know, the IV and the output of SHA-256 are identical in size. Suppose the input value to the SHA-256 is completely transparent. Is there any correlation between IV value and output? Is it possible to limit the output space?

No, you cannot limit the output space by altering the IV, if that's what you mean. The IV is a particular size, the inner state of the hash function which is identical to the native output size. You cannot just alter the inner state size without altering the hash function itself.

Fortunately, you don't need to. You can simply take as many bits from the output as you would like, and you'd still have the same inner strength of the hash function even though the size of the output does of course alter the strength of the resulting hash against pre-image and collision resistance.

As NIST states you would normally execute a specific formula to calculate the IV for a specific output size. This is specified in the NIST standard that defines SHA section 3.5.6 on SHA-512/t where $t$ is the output size.


The above doesn't clearly answer the additional question that is hiding in the middle:

Is there any correlation between IV value and output?

Yes, of course, any change to the initial value (IV) will directly affect all bits of the output. To restate the previous part of the answer: the size of the IV is fixed for SHA-256 and SHA-512 to the inner state size / native output size, 256 and 512 bits respectively.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.