1
$\begingroup$

Here, an user says about using a seed to generate a key that is larger than the digest size:

"Do not use hash chaining: that's a bad way of constructing a key derivation function from a hash. If the output is H(S) || H(S||H(S)) || H(S||H(S||H(S))) || …, then it's possible to reconstruct the whole output from the first n bytes where n is the length of the hash. How bad this is depends on how you're using the output material, but even if it's not completely broken, it's less secure than it could be with the same level of complexity and performance."

H is the hash, S is the seed.

I would like to know why this applies to chaining used in that case.

$\endgroup$

1 Answer 1

1
$\begingroup$

If the output is H(S) || H(S||H(S)) || H(S||H(S||H(S))) || …, then it's possible to reconstruct the whole output from the first n bytes where n is the length of the hash.

I don't believe that the Gilles is correct at this point; for a standard cryptographical hash function (e.g. SHA-256), it is usually not possible in general to predict $H(S || X)$ from $X$, $H(S)$; this remains true even if we give the attacker a long series of $(X', H(S || X'))$ pairs.

And, the only reason I say that it is "usually" not possible (rather than give a blanket statement) is the existence of length extension attacks that apply to some hash functions (including SHA-256); there, it may be possible (but only if $S$ had the right length and the bits in $X$ happened to be the correct values - not likely in this case). And, these length extension attacks do not apply to other hash functions, such as SHA-3.

$\endgroup$
2
  • $\begingroup$ Maybe the attack he had in mind was bruteforcing S? $\endgroup$
    – swineone
    Mar 3, 2023 at 1:26
  • $\begingroup$ @swineone: such a brute force attack would work against any bitstream generator that was seeded solely by a weak key... $\endgroup$
    – poncho
    Mar 3, 2023 at 2:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.