2
$\begingroup$

Just want to be sure about something before I sign off on a method we're about to put into place.

We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the secret.

The secret and the user-key is then hashed with SHA512 to obtain results.

Given the ending hash is SHA512, and the user only knows the SHA256, a hash length extension attack would be impossible, correct? As there is no way to convert a 256 to 512, or to backtrack the 256?

From every angle I can see it, it shouldn't be possible. But want to confirm with those more well versed than I. Thanks.

|improve this question
$\endgroup$
  • 1
    $\begingroup$ Of course, it would probably be better is the user can see a commitment to the secret instead of the SHA256 hash of the secret, and if the user-key is then HMACed with the secret instead of them being hashed with SHA512. $\;$ $\endgroup$ – user991 May 22 '15 at 5:34
  • $\begingroup$ Guys, maybe something for meta, but I see very few people upvoting questions. Now I can understand not upvoting questions if they are too specific but there seems to be a growing gap between the amount of upvotes for answers and questions. $\endgroup$ – Maarten Bodewes♦ May 22 '15 at 13:27
  • $\begingroup$ Even if there's no known way I would recommend creating a canonical representation of messages, e.g. by prefixing the length for the user-key. Somebody may look at your code and decide that using a single hash function would be more efficient. At the very minimum create a design document and comment your code. $\endgroup$ – Maarten Bodewes♦ May 22 '15 at 13:31
3
$\begingroup$

No, there is no known way.

It would actually be rather surprising if there were even a theoretical way; the SHA-256 and the SHA-512 compression functions are rather different (for one, one works with 32 bit words and the other works with 64 bit words); one wouldn't expect them to share any sort of relation.

|improve this answer
$\endgroup$
  • $\begingroup$ Just out of curiosity, would the different initial values be enough to thwart a length extension attack? $\endgroup$ – Maarten Bodewes♦ May 22 '15 at 23:30
  • $\begingroup$ @MaartenBodewes: yes; different initial values would. In fact, that's precisely the reason why (for example) SHA-256 and SHA-224 use different initial values. $\endgroup$ – poncho May 23 '15 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.