12
$\begingroup$

Does the SHA-512 value of an input leak any information about the SHA-256 value of that same input?

Specifically, if I'm using SHA-512 to derive encryption and HMAC keys from a 256 bit ECDH shared secret (by splitting it into two 256 bit chunks), does publishing a SHA-256 fingerprint of that shared secret reveal any useful info about the derived keys?

$\endgroup$

migrated from security.stackexchange.com Dec 10 '16 at 21:22

This question came from our site for information security professionals.

13
$\begingroup$

does publishing a SHA-256 fingerprint of that shared secret reveal any useful info about the derived keys?

No such leakage is known, and it would look quite unlikely. The SHA-256 and SHA-512 compression functions (which process the hashed messages) differ in a number of significant details (including the size of the words being processed); any such correlation would be quite surprising.

So, your approach looks reasonable. Of course, if you want to be totally cautious, you can rely on a similar mechanism which has been cryptography studied for this specific security property; you could do:

$EncryptionKey = HMAC( ECDH, \text{'Encryption'} )$

$MacKey = HMAC( ECDH, \text{'Mac'} )$

$Fingerprint = HMAC( ECDH, \text{'Fingerprint'})$

An explicit assumption with HMAC (as a Message Authentication Code) is that if you get the HMAC of one message (say, the string "Fingerprint"), that doesn't help the attacker determine the HMAC of another message (either "Encryption" or "Mac")

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy