13
$\begingroup$

I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit. In software like GnuPG and OpenPGP, is there any real benefit using a SHA-512 key over a SHA-256 key with the AES-256-CBC block cipher?

$\endgroup$
  • $\begingroup$ Who says that AES256 has to use a key generated from SHA2 (from what data)? Depending on the use case and other details, this might be very bad. $\endgroup$ – deviantfan Nov 13 '16 at 23:19
  • $\begingroup$ Other than that, CBC needs an IV. $\endgroup$ – deviantfan Nov 13 '16 at 23:20
  • 2
    $\begingroup$ It sounds like you're actually asking why AES-256-CBC might be paired with SHA-512. That doesn't mean SHA-512 is used to generate keys. It may also be used as an HMAC to authenticate the ciphertext. $\endgroup$ – Stephen Touset Nov 14 '16 at 5:47
  • 3
    $\begingroup$ Note: PGP (including implementations like GnuPG) never uses CBC mode of AES nor any other suppported cipher, although as answered it can use either SHA-256 or SHA-512 (and for that matter SHA-224 and SHA-384 and more) for password-based key derivation $\endgroup$ – dave_thompson_085 Nov 14 '16 at 8:54
14
$\begingroup$

SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it uses 64 bit word size, which works best on 64 bit processors. You can see a good comparison table on Wikipedia

If less bits are required from SHA-512 then they are generally just taken from the left of the output (it doesn't matter which bits are used, this is just convention). There are also specialized constructs such as SHA-512/256 that use different initial values. This should be used in case the leakage of a partial hash is a problem within the specific protocol.

That said there are no attacks on SHA-256 that come close to breaking that particular algorithm, so it can still be used with some kind of confidence.


There is no such thing as a SHA-256 or SHA-512 key. SHA-2 may be used to derive keys though, for instance using HKDF. For key derivation it is best to use the hash as part of a HMAC function to create a PRF.

As deviantfan commented, CBC requires an IV. The additional output of the SHA-512 function could be used to deliver those additional 128 bits.


For GPG specifically, RFC 4880: OpenPGP Message Format specifies in section 3.7.1.1: Simple S2K:

If the hash size is greater than the session key size, the high-order (leftmost) octets of the hash are used as the key.

This is also the method used for Salted S2K and Iterated and Salted S2K as those expand the Simple S2K function.


Note that there is a specialized SHA-512 version called SHA-512/256 standardized by NIST, which let you use a version of SHA-512 with reduced output. It uses different constants which could fend of some attacks as the start of a hash may tell an attacker something about the full hash. Obviously it therefore produces different output than (the leftmost bytes of) SHA-512. SHA-512/256 should be used instead of SHA-512 in new protocols if your target platforms support it.

$\endgroup$
  • $\begingroup$ So, even though it truncates a SHA-512 hash down to the 256 bits that AES CBC needs, you would still pick SHA-512? And I was right in saying AES simply chops the derived key down to the requirement? $\endgroup$ – user4191887 Nov 13 '16 at 23:41
  • $\begingroup$ 1. Depends on the platforms. For a 64 bit high end platforms I'd probably use SHA-512 or one of the 3 derivatives, yes. If a 32 bit or lower platform is also required, keep to SHA-256. 2. AES is a block cipher. It requires a 128, 192 or 256 bits. It doesn't do any cutting etc. out of itself. It depends on the protocol how the key is derived. Any AES implementation that accepts any other key size than the ones above should not be used (hi, mcrypt). $\endgroup$ – Maarten Bodewes Nov 13 '16 at 23:57
  • $\begingroup$ Well with implementations in GPG, it uses s2k or string-to-text. You are able to configure it to use AES-256 with SHA-512. Does this mean that it is deriving the key from the user password over many iterations. Then the result is still 512 bits, how does AES-256 use the 512bit derived key? $\endgroup$ – user4191887 Nov 14 '16 at 0:14
  • $\begingroup$ For that specific protocol, RFC 4880 specifies this directly: "If the hash size is greater than the session key size, the high-order (leftmost) octets of the hash are used as the key." So the protocol follows common practice, yes. (I think you meant string-to-key instead of string-to-text by the way.) $\endgroup$ – Maarten Bodewes Nov 14 '16 at 0:38
  • 2
    $\begingroup$ Oops, even though SHA-512 has more rounds, it processes twice at much data at once. So yes, it's definitely faster in MB/s on most 64-bit CPUs! Not because 64-bit ops are faster, but because they're the same speed as 32-bit ops. For example, this implementation and benchmark found 207.6MB/s for SHA-512 vs. 133.3MB/s for SHA-256, single-threaded on a Core2 2.4GHz. $\endgroup$ – Peter Cordes Nov 14 '16 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.