3
$\begingroup$

I'm new in Cryptography, if i will use SHA512, but only with 256 bits, is it equal or similar to SHA256?

I'm trying to understand if there is a way to use SHA512 as SHA256

$\endgroup$

2 Answers 2

3
$\begingroup$

No, SHA-512 and SHA-256 are different hash functions, both belonging to the SHA-2 family of hashes. There are variants of SHA-2 called "truncated SHA-2", from the Wikpedia page:

SHA-224 and SHA-384 are truncated versions of SHA-256 and SHA-512 respectively, computed with different initial values. SHA-512/224 and SHA-512/256 are also truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.

I never liked the idea of truncation, because it's not clear how that affects the target space distribution of the hash function. My recommendation is to stick with either full SHA-512 or full SHA-256, but I don't know if there is a stronger mathematical basis to justify that.

$\endgroup$
6
  • 4
    $\begingroup$ SHA-512/256 and the (different) SHA-512 truncated to it's first half are often used as functional replacement of SHA-256 because they are typically faster (for large messages) when implemented in software on 64-bit CPUs. They are believed at least as strong. There are very convincing arguments for that when it comes to first preimage resistance, and convincing enough arguments for second preimage and collision. $\endgroup$
    – fgrieu
    Commented Feb 2, 2023 at 9:21
  • 1
    $\begingroup$ Thanks for adding that info, but to clarify, they are faster because SHA-512 is faster, right? Since it works on 64 byte blocks? And then the truncation is done only to save storage, If I understand correctly $\endgroup$
    – Amit
    Commented Feb 2, 2023 at 9:31
  • 3
    $\begingroup$ SHA-512 can be faster (for large messages) because the message is truncated into 128-byte chunks rather than 64-byte chunks in SHA-256, thus there are about half as many invocations of the compression function. On 64-bit CPUs this more than offsets the 16 extra rounds (80 vs 64) in the SHA-512 compression function, because each round involves similar operations in SHA-512 and SHA-256, save for being on 64-bit words on SHA-512 vs 32-bit on SHA-256, and the word size difference has marginal impact on their cost on 64-bit CPUs. $\endgroup$
    – fgrieu
    Commented Feb 2, 2023 at 9:46
  • $\begingroup$ Thank you for answer, so as i able to understand, truncated SHA-512 can be replacement of SHA-256, and its strong as SHA-256? please, did you aware of some reference about it? $\endgroup$
    – ish
    Commented Feb 2, 2023 at 10:08
  • 3
    $\begingroup$ Note that SHA-1 and SHA-256 have hardware instructions on many Intel compatible processors right now. If those instructions are used then SHA-256 is again faster than SHA-512. $\endgroup$
    – Maarten Bodewes
    Commented Feb 2, 2023 at 11:27
1
$\begingroup$

I understand your question to mean: do SHA-256 and SHA-512-truncated-to-256-bits have the same security properties?

The short answer is yes. We have no reason to believe that SHA-512-truncated-to-256-bits is more or less secure than SHA-256, except that SHA-512-truncated-to-256-bits is actually more secure in one respect which I'll explain below.

SHA-256 and SHA-512 have very similar designs. It's unlikely that an attack other than brute force would work on one but not the other. And brute force is out of reach of the foreseeable future (even with quantum computers).

If you have a protocol that uses SHA-256, the protocol will be as secure if you use SHA-512-truncated-to-256-bits instead throughout. However, rather than SHA-512-truncated-to-256-bits, you should use SHA-512/256 (see Wikipedia for a definition and references). SHA-512/256 is a slightly modified variant of SHA-512 with different constants. The advantage of using different constants is that it avoids accidental identities if different parts of the protocol also use SHA-512. For example, suppose a protocol uses SHA-512(x) as a key and SHA-256(x) as an IV (where x is some secret key); if you use SHA-512-truncated-to-256-bits(k) as the IV, you're exposing half of the key. Real-world examples of this kind of problem are often much harder to spot, hence the advice to not just truncate a hash.

There is one respect where a truncated SHA-512 (whether it's SHA-512-truncated-to-256-bits or SHA-512/256) is actually more secure than SHA-256. That's when the hash function is used for properties stronger than a hash function, such as to construct a MAC or a pseudorandom value. SHA-512 and SHA-256 are vulnerable to length extension attacks: if you know SHA-256(x) and length(x) but not x itself, there is a suffix y that you can append to x such that SHA-256(x||y) is known. This attack does not apply if the hash is truncated.

Note that in practice, the only advantage of SHA-512 over SHA-256 (other than the longer size, but you don't care about that) is that it's faster on 64-bit processors without acceleration. That's only an advantage if none of the computers involved in your protocol are 32-bit processors or 64-bit processors that have SHA-256 acceleration but not SHA-512 acceleration.

$\endgroup$
1
  • $\begingroup$ It's worth adding that the widely adopted HMAC algorithm, is not prone to length extension attacks for any hash used in conjunction with it, due to its clever construction. $\endgroup$
    – Amit
    Commented Feb 12, 2023 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.