# Safety of nested hashes

Assume that you use this function: SHA-256(key_1 + SHA-256(key_2 + SHA-256(key_3 + special_key))). First, second and third keys are long random strings of 64 bytes. A special key is a short string (from 5 to 12 bytes). Also, assume that an attacker has:

• the special key;
• 16 bytes from the beginning of the function result.

How realistic is it for an attacker to obtain the keys 1, 2 and 3? Is there any vulnerability, except brute force? And if the attacker has multiple pairs of key/result string?

• HMAC derives its two key_j from a single one (using XOR with constants) rather than using independent keys;
• HMAC's security model includes the adversary choosing the messages (that is, values of special_key) for which it obtains input; and seeking something weaker than key recovery (ability to distinguish the function from random).