7
$\begingroup$

SHA-1 has an operation within round j in stage t, where the functions $f_t$ and $K_t$ change depending on the stage.

diagram of sha-1 round function

Is there a specific reason why the variable $A$ is rotated by 5? How does this improve security? And why not rotate the variable by 30 like $B$ is?

I have the same question about $B$: why is the variable rotated and why isn't it rotated by a different amount?

$\endgroup$
9
$\begingroup$

Most the other operations you see in the round – XORs and $f_t$ – are bitwise functions. Without rotations every bit would only affect the corresponding bits in the other words and the higher bits in some words due to carry propagation. That means the low order bit would be affected by only the low order bits of the inputs $W_j$ and $K_t$, allowing simple inversion in the case of SHA-0 (where $W_j$ themselves are straight up combinations of input words) and significantly weaken SHA-1 (where $W_j$ are rotated).

So you need some rotations – or other operations like right shifts – to allow bits at different positions to mix completely.

The particular numbers (rotation constants) are not quite as important, but 5 and 30 are are different enough and not large factors of the word size (e.g. consider 16). There are some possibly better ones (pdf), but 5 and 30 (= -2) are also small, which at least used to matter in some low performance computational units.

$\endgroup$
  • $\begingroup$ Thanks! Do you also know why the variable $B$ was chosen to rotate over, for example, $C$ or $D$? $\endgroup$ – Cartman123 Aug 28 '16 at 8:33
  • $\begingroup$ @Cartman123, the paper and presentation that I linked mention that possibility but do not show any results. I don't know if it makes any difference, but I doubt it since all of the middle three words are treated similarly. $\endgroup$ – otus Aug 28 '16 at 8:48
  • 1
    $\begingroup$ It is also noteworthy that intra-word bits are also related to each other through the carry propagation of modular additions in each round (the plus boxes). $\endgroup$ – saeedn Aug 28 '16 at 18:42
  • 1
    $\begingroup$ @saeedn, yes, I should have been clearer, since that does propagate bits, but only to the left. $\endgroup$ – otus Aug 29 '16 at 5:57
  • 1
    $\begingroup$ @fgrieu, thanks, I added something to that effect. $\endgroup$ – otus Aug 29 '16 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.