3
$\begingroup$

I'm learning about cryptographic hash functions and I have some questions about SHA-2.

SHA-256 uses 8 32-bit words. SHA-512 uses 8 64-bit words.

Is there a specific reason why SHA-512 uses 64-bit words? Why not 16 32-bit words?

And if 64-bit words have their advantages over 32-bit words. Why doesn't SHA-256 use 4 64-bit words?

$\endgroup$
  • 1
    $\begingroup$ It's not used much, but NIST has put out a revision of the SHA-2 docuemnt to specify SHA-512/256 and SHA-512/224 - which are basically SHA-512 cut down to the right bit size (and different internal constants, to make the calculations differ). On 32 bit machines (or, e.g. in smart cards, augmented 8 or 16 bit machines) SHA-256 is faster, due to the smaller state size etc. So well, they kind of released a 64 bit version of SHA-256, only more secure, for 64 bit optimized processors. $\endgroup$ – Maarten Bodewes Sep 30 '16 at 22:44
5
$\begingroup$

The main reason of using 64-bit word size over 32-bit word size is speed, on CPUs that manipulate words sequentially. Doubling the word size can hope to about double the number of elementary bitwise operations performed in a given amount of time, on a 64-bit CPU like one using the AMD64 instruction set.

As an aside, for constant number of words in the internal state of a an algorithm (like a hash), the number of bits in the state is twice as large, which can improve the cryptographic resistance (if other conditions apply; in particular, at least twice as many bit operations); and allows a larger result.

Accordingly, for large input, SHA-512 is typically faster than SHA-256 on the same 64-bit CPU, even though SHA-512 uses 25% more rounds, and has a state with twice more bits, making it arguably safer.

Update per comment: word size has no direct impact on security. As an illustration, it is possible to reformulate SHA-512 as using 32-bit words, with identical result thus security; compilers for 32-bit CPUs do this automatically.

$\endgroup$
  • $\begingroup$ Thanks! But generally speaking hash functions with 64-bit word size are more secure than those with 32-bit word size right? That's what it says here (security in bits). $\endgroup$ – Cartman123 Oct 2 '16 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.