11
$\begingroup$

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (for example: a random salt)? Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value.

Improve this question
$\endgroup$
5
  • $\begingroup$ "Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value." Not quite, the appended message length would be off by a few bytes. $\endgroup$
    – Thomas
    Oct 3 '12 at 13:45
  • $\begingroup$ What would be the benefits? $\endgroup$
    – Stephen Touset
    Sep 5 '14 at 5:08
  • $\begingroup$ @StephenTouset the benefit would be essentially the same as HMAC/NMAC provides, which is to change that initial hash value using a key $\endgroup$
    – Richie Frame
    Sep 5 '14 at 8:42
  • $\begingroup$ Why not simply use HMAC or NMAC, then, which have security proofs? $\endgroup$
    – Stephen Touset
    Sep 5 '14 at 17:30
  • 1
    $\begingroup$ NMAC/HMAC literally just hashes the key first to create the initial value, instead of using the key directly, and does it with 2 different keys in a wrapped structure. The security proofs require the hash to be a secure PRF, which is not completely fulfilled in practice. $\endgroup$
    – Richie Frame
    Sep 5 '14 at 19:45
11
$\begingroup$

With the message padding scheme of SHA-2/SHA-256 as it stands (add one 1 bit, a minimal number of 0 bits so that the overall padded message will end on a block boundary, then the original message length over some fixed number of bits), I know no attack enabled by allowing a different IV.

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ Thanks. I need to read your answer a few times, but this was the kind of insight I was seeking. $\endgroup$
    – ericball
    Oct 3 '12 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.