If I hash a keyword with SHA-512 and then feed the output as the key for the next round ....and keep repeating this process, will I gather a stream of random numbers?

  • 2
    $\begingroup$ pseudorandom yes, depending on your use of the outputs, the method you described may be a massive security risk $\endgroup$ Commented Apr 9, 2014 at 8:38
  • 2
    $\begingroup$ crypto.stackexchange.com/questions/48/… describes some of the problems you may run into with schemes like this. $\endgroup$
    – archie
    Commented Apr 9, 2014 at 9:07

2 Answers 2


For an adversary not knowing the definition of SHA-512 (or just not knowing the 512-bit initialization constant of SHA-512, defined as the first sixty-four bits of the fractional parts of the square roots of the first eight prime numbers), the sequence obtained by $$\begin{align*} H_0&=\text{SHA-512}(Seed){\small\text{ where }}Seed{\small\text{ is the statement's keyword}}\\ H_{i+1}&=\text{SHA-512}(H_i)\\ \end{align*}$$ is a Cryptographically Secure Pseudo-Random Number Generator as far as we know. It is in practice indistinguishable from random for said adversary, with residual odds of the contrary less than $2^{-100}$, assuming a few additional requirements:

  1. Less than $2^{200}$ outputs are available to the adversary [rationale: if it happens that the generator enters a cycle, then the adversary can predict future output, including with feasibly little memory; after about $2^{(512-100+1)/2}$ iterations of a random function with 512-bit output, odds of cycling are about $2^{-100}$; I kept some margin]. Notice that producing even the first $2^{60}$ outputs would take at least five years with current technology, because this RNG and SHA-512 are a serial process [estimate based on two gate delays each one picosecond per round].
  2. This adversary uses classical computing means bound to perform less work than needed for $2^{250}$ hash computations (a safe assumption), or anything that I can fantasize today (your call) [rationale: the best explicit attack I have enumerates the SHA-512 initialization values, and that reaches odds $2^{-100}$ to succeed at about $2^{412}$ hashes; I kept a helluva of margin]; Note: 1 and 2 can be combined into the adversary can not perform the classical-computing equivalent of counting to $2^{200}$, which is still very credible.
  3. $Seed$ is never reused.
  4. The adversary does not obtain the SHA-512 specification (including initialization value) by some oblique mean: reverse engineering, operating goof, spying (including bribery and planting trojans), rubber hose cryptanalysis, side channels.. [Note: reading the official specification was discounted in the first sentence].

However, with respect to an adversary knowing the full definition of SHA-512 (which is the assumption a cryptographer will make by Kerckhoffs's principles), the generator is unsafe. In particular, $H_j$ for $j>i$ can be trivially predicted from $H_i$; the generator fails the next bit test.

In addition, from a practical perspective, the generator is very bad by the mere fact that it is simultaneously

  • deterministic;
  • without another key than a keyword presumably of low entropy;
  • without provision for key streching to slow keyword enumeration.

If the keyword is simple enough to be reliably memorized in a real application by a majority of adult humans, then password cracking can quickly find the keyword by enumeration knowing say 10 bytes of $H_0$.

So all in all, the generator is secure for some non-cryptographic applications like numerical simulations, and disastrous from the perspectives on-topic here.

  • $\begingroup$ But if published result of each SHA512 invocation is just first 256 or 128 bit, then it should be safe. Ie Si = SHA512(Si-1), Hi = first256bit(Si) . $\endgroup$ Commented Nov 11, 2021 at 8:42
  • $\begingroup$ Then it could be extended with mixing seed every time: Si = SHA512(Si-1 || Seed) $\endgroup$ Commented Nov 11, 2021 at 8:43
  • $\begingroup$ And then it could be extended with mixing both Seed and iteration number: Si = SHA512(Si-1 || Seed || i) $\endgroup$ Commented Nov 11, 2021 at 8:45

The definition of "random" is something not very clear that deserves some more explanation, like what you expect from the output number sequence.

  • If you want an uniformed distributed sequence you will get it.

  • If you want an unpredictable sequence you won't.

  • If you want a "sequence undistinguishable from random" you won't get it either.

  • 3
    $\begingroup$ Strictly speaking, the sequence is not uniformly distributed: it will ultimately enter a cycle (that's expected after roughly $2^{256}$ hashes), and it is extremely unlikely that the mean number of $1$ in this cycle is exactly $1/2$, a requirement for any uniformly distributed ultimately cyclic sequence. $\endgroup$
    – fgrieu
    Commented Apr 9, 2014 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.