What is the purpose of expanding then shrinking in SHA-1? Does it serves any security purposes?


1 Answer 1


Expanding then shrinking in SHA-1 refers to the process, performed for each round (each 512-bit block of padded message), of

  • message expansion from 512 bits to 2560 bits;
  • keeping only 160 bits of state for the next round.

The later directly follows from the construction of SHA-1 as a Merkle-Damgård hash of 160 bit. The former occurs because SHA-1's compression function is built from a block cipher using the Davies-Meyer construction, that is with the message entering the block cipher's (512-bit) key input; and, as most block ciphers do, the particular block cipher used in SHA-1 uses a key schedule, expanding the key to 80 subkeys (each 32-bit), one per round.

The expanding in SHA-1 is thus the key schedule of its block cipher, and is there to make SHA-1's internal block cipher secure, making SHA-1's compression function collision-resistant, making SHA-1 collision-resistant.

As an illustration that the key schedule/expansion plays a security role, the short-lived SHA (now known by the retronym SHA-0) differs from SHA-1 by a weaker key schedule (with one less word rotation), and is more badly broken than SHA-1 is (in particular, by Yusuke Naito, Yu Sasaki, Takeshi Shimoyama, Jun Yajima, Noboru Kunihiro, Kazuo Ohta: Improved Collision Search for SHA-0, in proceedings of ASIACRYPT 2006).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.