Assume that you use this function: SHA-256(key_1 + SHA-256(key_2 + SHA-256(key_3 + special_key))). First, second and third keys are long random strings of 64 bytes. A special key is a short string (from 5 to 12 bytes). Also, assume that an attacker has:

  • the special key;
  • 16 bytes from the beginning of the function result.

How realistic is it for an attacker to obtain the keys 1, 2 and 3? Is there any vulnerability, except brute force? And if the attacker has multiple pairs of key/result string?


This is similar to HMAC-SHA-256 with 64-byte key, except that

  • HMAC-SHA-256 has two SHA-256 layers where there is three;
  • HMAC derives its two key_j from a single one (using XOR with constants) rather than using independent keys;
  • HMAC potentially reveals its whole 32-byte output, rather than part of it;
  • HMAC's security model includes the adversary choosing the messages (that is, values of special_key) for which it obtains input; and seeking something weaker than key recovery (ability to distinguish the function from random).

It follows this is at least as strong as HMAC-SHA-256 is: with a strong theoretical argument even for relatively weak hypothesis on SHA-256 (the generic proof of HMAC applies), and unbroken.

Key leak by some side channels might still be an issue for a particular implementation, though.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.