Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that?
Links:
$\begingroup$
$\endgroup$
3
-
2$\begingroup$ If you really need a cryptographic hash function with a large output you could try Skein-1024. It has the added advantage of not being designed by NSA. $\endgroup$– NDF1Aug 21, 2014 at 4:44
-
2$\begingroup$ If you need a large output size, but don't care to have the 256-bit security of SHA-512, there is SHAKE256 which has a parameter to extend output size at will. $\endgroup$– fgrieu ♦Sep 2, 2021 at 16:42
-
$\begingroup$ I guess that MGF1 or other constructions to build generic PRFs may also be used. If you need that kind of functionality you may want to ask a specific question. $\endgroup$– Maarten Bodewes ♦Sep 4, 2021 at 16:06
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
3
No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.)
If you think large quantum computers will be efficient, a 512-bit hash makes some sense, but even then a 1024-bit one wouldn't. A quantum computer requires $O(2^{n/3})$ operations to find break the collision resistance of a secure $n$-bit hash.
Finally, SHA-256 uses 32-bit words and SHA-512 64-bit. If you wanted to use the same way to extend SHA to 1024-bit state, you would need to use 128-bit operations which are slow on practically all platforms.
-
3$\begingroup$ I'd like to note that from a (perhaps uninformed) prespective, the fact that it's slow on current platforms doesn't provide extra security. It simply provides an easy avenue for an attacker to amass a large amount of password-bruteforcing power with a custom device that supports 128-bit operations. $\endgroup$ Aug 19, 2014 at 0:03
-
$\begingroup$ SHA-512 is an unbreakable as 640K is enough RAM for everyone. $\endgroup$ Oct 15, 2021 at 22:50
-
$\begingroup$ @étale-cohomology That's completely different. The collision resistance of a hash function has mathematical proofs of complexity. SHA-2 can be weak for other reasons than size, but then it would not help to just make it bigger. $\endgroup$– otusOct 16, 2021 at 6:16
$\begingroup$
$\endgroup$
The Secure Hash Standard and corresponding FIPS-180/202 do not specify any hash to meet a security requirement above 256-bits (using a 512-bit hash). This is unlikely to change.
SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general purpose registers. This meant that the state was built with 8-words to meet the 2 most common security requirements.
Support of a larger digest would either require the core compression function to be different (as there would need to be more word inputs) or a larger word size, which did not exist (and still does not) except in specialized processors or SIMD registers (without appropriate instructions). The combination of no need and no can do meant there was no design of a 1024-bit state SHA-2 hash function.
Sponge functions on the other hand allow security to be determined by a combination of sponge capacity and output length. Keccak supports an internal security level up to almost 800-bits, but at a substantial performance hit. SHA-3 is built from Keccak.
While SHA-3 does not specify a hash with security above 256-bits, it does specify an extendable output function SHAKE256, which is a function with variable length outputs at a 256-bit internal security. SHAKE256-1024 would be a 1024-bit digest with the effective security of a 512-bit hash.
answered Aug 19, 2014 at 11:28