I was reading this answer about why there is no such thing as a SHA-1024 hash:

SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), which use 32 and 64-bit maximum CPU word sizes for general purpose registers. This meant that the state was built with 8-words to meet the 2 most common security requirements.

Support of a larger digest would either require the core compression function to be different (as there would need to be more word inputs) or a larger word size, which did not exist (and still does not) except in specialized processors or SIMD registers (without appropriate instructions).

Why can't SHA-512 or SHA-256 simply be reused instead to create a longer hash, eg. by concatenating hash(string) and hash(string + 1)? Does this pose a security concern, speaking of hashes in general?

I have little knowledge of the internals of hashing algorithms, but I think that if it takes an average time T to find a collision on hash(string), it should take an average time T^2 to find a collision on hash(string) concat. hash(string + 1).


1 Answer 1


That article is talking about the core function and state size. It's easy to get a larger output using a whole range of instructions. Using a counter, like your example, does indeed constitute a correct way of generating more output. It's extensively used in constructions for creating a pseudo random function (CSPRNG or DRBG) or key derivation function (KDF).

The problem is that if you want to also have 1024 / 512 bit security you'd need to use a larger state. In that case you'd need a different construct, or you'd have to use 128 bit instructions. Your example doesn't use a larger state and therefore is unlikely to provide full 1024 / 512 bit security. Currently however 128 / 256 bit security is deemed plenty, so there is very little reason to go that way.

If you want to have a hash function with the same security and still larger output, you might have a look at the SHA-3 XOF's: SHAKE-128 and SHAKE-256. Due to the construction of the sponge it's easy to generate more output while the internal state (and thus the security) remains the same. It's basically still SHA-3, it doesn't even need alteration of the core function nor an external construction using a counter.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.