I know bit independence is good in SHA2 function output, but is it truly 100% secure? For example:
- Y = SHA512(secretKeyNonce256bit)
- A = first 32ytes / 256bits of Y, used as message encryption key
- B = next 16bytes/128bits used as authentication HMAC key for message
- C = next 16bytes/128bits used as access code. NON-SECRET, and known to message carrier. If user provides this code, he is given the encrypted message by the carrier.
Does having knowledge of C yield some insight into A,B? Would it be better to instead use C2=first 16 bits of SHA256(C) ?
One weakness, which extra SHA does not prevent, is if secretKey were derived from a crummy password [not the case here], C would be valuable to whoever attempted brute-like password guessing, because if a tried password produces C, it is likely that the password is correct & can produce correct A, B. Some people may mention 128bit HMAC is on a weaker side, but I think 128 / 64bit collision resistance is sufficient for my application.