# Why does Fortuna RNG use double SHA-256?

In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256.

Why? What's the benefit? What happens if I use single SHA-256 or RIPEMD-256, for example?

• I haven't read the paper, but I would expect it's to prevent length-extension attacks on the MD-construction (which is the internal design used by SHA-256). Mar 27 '14 at 9:59
• Thanks for the reply. I guess that affects RIPEMD-256 also. Am I wrong? Mar 27 '14 at 10:48
• BTW: the paper says nothing about why it chooses double SHA. The only reference to both SHA-256 and double SHA is in this sentence: "A typical hash function, like SHA-256, and hence SHAd-256, processes message inputs in fixed-size blocks". The rest of the paper it uses double SHA-256 for everything. Mar 27 '14 at 10:49
• I believe you will find the answer in Practical Cryptography Chapter 6.3.1 Length Extensions Mar 28 '14 at 11:03

• @CodesInChaos Sure. The SHA-2 512/256 truncation mode would also prevent length extension attacks without requiring a second hash. But that was published in (?)2011 and Fortuna was published in 2003. Today I think it might make sense to use SHA-3 (or any SHA-3 finalist) in place of $SHA_d\text-256$. Aug 25 '18 at 20:24