FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (for example: a random salt)? Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value.
$\begingroup$
$\endgroup$
-
$\begingroup$ "Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value." Not quite, the appended message length would be off by a few bytes. $\endgroup$ – Thomas Oct 3 '12 at 13:45
-
$\begingroup$ What would be the benefits? $\endgroup$ – Stephen Touset Sep 5 '14 at 5:08
-
$\begingroup$ @StephenTouset the benefit would be essentially the same as HMAC/NMAC provides, which is to change that initial hash value using a key $\endgroup$ – Richie Frame Sep 5 '14 at 8:42
-
$\begingroup$ Why not simply use HMAC or NMAC, then, which have security proofs? $\endgroup$ – Stephen Touset Sep 5 '14 at 17:30
-
1$\begingroup$ NMAC/HMAC literally just hashes the key first to create the initial value, instead of using the key directly, and does it with 2 different keys in a wrapped structure. The security proofs require the hash to be a secure PRF, which is not completely fulfilled in practice. $\endgroup$ – Richie Frame Sep 5 '14 at 19:45
$\begingroup$
$\endgroup$
With the message padding scheme of SHA-2/SHA-256 as it stands (add one 1 bit, a minimal number of 0 bits so that the overall padded message will end on a block boundary, then the original message length over some fixed number of bits), I know no attack enabled by allowing a different IV.
However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.
-
2$\begingroup$ Thanks. I need to read your answer a few times, but this was the kind of insight I was seeking. $\endgroup$ – ericball Oct 3 '12 at 14:28
