# Does SHA-1024 hash exist?

Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that?

• If you really need a cryptographic hash function with a large output you could try Skein-1024. It has the added advantage of not being designed by NSA. – NDF1 Aug 21 '14 at 4:44

No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.)

If you think large quantum computers will be efficient, a 512-bit hash makes some sense, but even then a 1024-bit one wouldn't. A quantum computer requires $O(2^{n/3})$ operations to find break the collision resistance of a secure $n$-bit hash.

Finally, SHA-256 uses 32-bit words and SHA-512 64-bit. If you wanted to use the same way to extend SHA to 1024-bit state, you would need to use 128-bit operations which are slow on practically all platforms.

• I'd like to note that from a (perhaps uninformed) prespective, the fact that it's slow on current platforms doesn't provide extra security. It simply provides an easy avenue for an attacker to amass a large amount of password-bruteforcing power with a custom device that supports 128-bit operations. – Reinstate Monica - ζ-- Aug 19 '14 at 0:03

The Secure Hash Standard and corresponding FIPS-180/202 do not specify any hash to meet a security requirement above 256-bits (using a 512-bit hash). This is unlikely to change.

SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general purpose registers. This meant that the state was built with 8-words to meet the 2 most common security requirements.

Support of a larger digest would either require the core compression function to be different (as there would need to be more word inputs) or a larger word size, which did not exist (and still does not) except in specialized processors or SIMD registers (without appropriate instructions). The combination of no need and no can do meant there was no design of a 1024-bit state SHA-2 hash function.

Sponge functions on the other hand allow security to be determined by a combination of sponge capacity and output length. Keccak supports an internal security level up to almost 800-bits, but at a substantial performance hit. SHA-3 is built from Keccak.

While SHA-3 does not specify a hash with security above 256-bits, it does specify an extendable output function SHAKE256, which is a function with variable length outputs at a 256-bit internal security. SHAKE256-1024 would be a 1024-bit digest with the effective security of a 512-bit hash.