is SHA512 with 256 bit set is similar or same as SHA256?

Question

I'm new in Cryptography, if i will use SHA512, but only with 256 bits, is it equal or similar to SHA256?

I'm trying to understand if there is a way to use SHA512 as SHA256

Answer 1

No, SHA-512 and SHA-256 are different hash functions, both belonging to the SHA-2 family of hashes. There are variants of SHA-2 called "truncated SHA-2", from the Wikpedia page:

SHA-224 and SHA-384 are truncated versions of SHA-256 and SHA-512 respectively, computed with different initial values. SHA-512/224 and SHA-512/256 are also truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.

I never liked the idea of truncation, because it's not clear how that affects the target space distribution of the hash function. My recommendation is to stick with either full SHA-512 or full SHA-256, but I don't know if there is a stronger mathematical basis to justify that.

Answer 2

I understand your question to mean: do SHA-256 and SHA-512-truncated-to-256-bits have the same security properties?

The short answer is yes. We have no reason to believe that SHA-512-truncated-to-256-bits is more or less secure than SHA-256, except that SHA-512-truncated-to-256-bits is actually more secure in one respect which I'll explain below.

SHA-256 and SHA-512 have very similar designs. It's unlikely that an attack other than brute force would work on one but not the other. And brute force is out of reach of the foreseeable future (even with quantum computers).

If you have a protocol that uses SHA-256, the protocol will be as secure if you use SHA-512-truncated-to-256-bits instead throughout. However, rather than SHA-512-truncated-to-256-bits, you should use SHA-512/256 (see Wikipedia for a definition and references). SHA-512/256 is a slightly modified variant of SHA-512 with different constants. The advantage of using different constants is that it avoids accidental identities if different parts of the protocol also use SHA-512. For example, suppose a protocol uses SHA-512(x) as a key and SHA-256(x) as an IV (where x is some secret key); if you use SHA-512-truncated-to-256-bits(k) as the IV, you're exposing half of the key. Real-world examples of this kind of problem are often much harder to spot, hence the advice to not just truncate a hash.

There is one respect where a truncated SHA-512 (whether it's SHA-512-truncated-to-256-bits or SHA-512/256) is actually more secure than SHA-256. That's when the hash function is used for properties stronger than a hash function, such as to construct a MAC or a pseudorandom value. SHA-512 and SHA-256 are vulnerable to length extension attacks: if you know SHA-256(x) and length(x) but not x itself, there is a suffix y that you can append to x such that SHA-256(x||y) is known. This attack does not apply if the hash is truncated.

Note that in practice, the only advantage of SHA-512 over SHA-256 (other than the longer size, but you don't care about that) is that it's faster on 64-bit processors without acceleration. That's only an advantage if none of the computers involved in your protocol are 32-bit processors or 64-bit processors that have SHA-256 acceleration but not SHA-512 acceleration.