Significance of rotation constants in SHA-512?

In a single round of SHA-512, in the operations $\Sigma_0(A)$, $\Sigma_1(E)$ why are the constants $28$, $34$, and $39$ used for the number of rotations? What significance do these numbers have? What if they are changed?

migrated from security.stackexchange.comJun 8 '14 at 19:27

This question came from our site for information security professionals.

• You are talking about bit rotations (bit shifts where bits shifted out are shifted in, or rotated back, where a normal bit shift might just introduce zero bits). You cannot change the SHA-512 algorithm by altering these bit shift distances, unless you want to invent a new (not SHA-512) algorithm. – pyramids Jun 8 '14 at 9:16
• @pyramids: I think that the question might be more along the lines of "Would this new non-SHA-512 algorithm still have some or all of the general properties of SHA-512? Would different values necessarily compromise collision resistance or pre-image resistance?" Unlike the initial hash or round values, the constants used for bit rotation are not explained in e.g. the wikipedia pseudocode. – Neil Slater Jun 9 '14 at 14:02

1 Answer

The SHA-2 family is built from a block cipher in a Davies-Meyer construction, where the message is considered they key, and the current hash value the plaintext. The 2nd set of constants in the SHA-512 round function is 14, 18, and 41. Rotations are also performed in the message expansion (key schedule), and are also important.

The block cipher at the center of the compression function must behave in a secure manner, and the rotational constants were chosen in such a way that the block cipher is resistant to standard cryptographic attacks. The round count was then fixed to meet the security requirement of the hash digest, plus some wiggle room for new attacks.

SHA-2 was developed in secret at the NSA, so the above is partly speculative, however we do have good examples of how improper choice of rotational constants can weaken a hash function. During the SHA-3 competition, the Skein hash function was successfully attacked using rotational cryptanalysis, and a change in the rotational constants was made to prevent the attack. The attack with the old rotational constants was 22 rounds more effective than the best attack on Skein with the new constants; that is 30% of the full round count, which is substantial.

The attack seemed to exploit the specific combination of rotations and modular addition, both of which are heavily used in the SHA-2 compression functions. The continued lack of highly effective attacks on SHA-2 implies that its rotational constants were chosen well. The way that rotations are used in SHA-2 and Skein differ, but poor constants would still have prevented proper diffusion within the round, or in the key schedule. The best attacks are still reduced round differential and biclique attacks, and are not practical.