Why is it so hard to make longer hashes?

Question

I was reading this answer about why there is no such thing as a SHA-1024 hash:

SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general purpose registers. This meant that the state was built with 8-words to meet the 2 most common security requirements.

Support of a larger digest would either require the core compression function to be different (as there would need to be more word inputs) or a larger word size, which did not exist (and still does not) except in specialized processors or SIMD registers (without appropriate instructions).

Why can't SHA-512 or SHA-256 simply be reused instead to create a longer hash, eg. by concatenating hash(string) and hash(string + 1)? Does this pose a security concern, speaking of hashes in general?

I have little knowledge of the internals of hashing algorithms, but I think that if it takes an average time T to find a collision on hash(string), it should take an average time T^2 to find a collision on hash(string) concat. hash(string + 1).

Answer 1

That article is talking about the core function and state size. It's easy to get a larger output using a whole range of instructions. Using a counter, like your example, does indeed constitute a correct way of generating more output. It's extensively used in constructions for creating a pseudo random function (CSPRNG or DRBG) or key derivation function (KDF).

The problem is that if you want to also have 1024 / 512 bit security you'd need to use a larger state. In that case you'd need a different construct, or you'd have to use 128 bit instructions. Your example doesn't use a larger state and therefore is unlikely to provide full 1024 / 512 bit security. Currently however 128 / 256 bit security is deemed plenty, so there is very little reason to go that way.

If you want to have a hash function with the same security and still larger output, you might have a look at the SHA-3 XOF's: SHAKE-128 and SHAKE-256. Due to the construction of the sponge it's easy to generate more output while the internal state (and thus the security) remains the same. It's basically still SHA-3, it doesn't even need alteration of the core function nor an external construction using a counter.