I just used this

hashed = str(bin(int(hashlib.sha512(input1).hexdigest(), 16))[2:])


and then just see that the first bit is always 1

I have noticed quite an odd pattern, that all SHA512 output's first bit is always 1, while the others are random. Why is this?

Does this mean that SHA512 only provides 511 bits of security?

Does this prove that SHA512 is not a random oracle?

• Hmmm, I happen to have a set of SHA512 hashes lying around; going through them, I don't see any 'first bit is always 1' behavior. Are you sure that's what you're seeing (and not, say, that your hashing utility always puts a fixed string in front of the output hash or something)? – poncho Jan 27 '17 at 21:32
• for i in seq 1 10 ; do head -c16 </dev/urandom | openssl sha512 ; done — all 512 bits look random to me. – squeamish ossifrage Jan 27 '17 at 21:36
• This is because you encode it as an int before making it a binary ascii string. That conversion throws away any starting 0 bits (i.e. 011 = 11 in binary). – DiscobarMolokai Jan 27 '17 at 21:46
• @cryptonoob400 The bin function call does not zero pad the output to 512 bits; Is the string you're examining even 512 bits long? – Ella Rose Jan 27 '17 at 21:52
• Go back and reread @DiscobarMolokai's response. You are silently discarding any leading zeroes with your series of conversions, and half the resulting bit-strings you're looking at are 512 bits long, a quarter of them are 511 bits long, an eighth of them are 510 bits long, etc. TL;DR, there are zeroes there, you're just not printing them because 0b00000001 == 0b1. – Stephen Touset Jan 27 '17 at 22:22

I have noticed quite an odd pattern, that all SHA512 output's first bit is always 1, while the others are random. Why is this?

You’re doing (read: coding) it wrong, which made you interpret things wrong. See, all SHA-512 that start (in hex notation) with 0 to 7 will have a ZERO as first bit, all others starting with 8 to F will start with a ONE as first bit.

Simplest example: take the SHA-512 of the letter a, and you’ll have a hash starting with a ZERO-bit.

SHA512("a") = 1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75


In binary that becomes…

HEX:    1    f |    4    0 |    f    c | …
BIN: 0001 1111 | 0100 0000 | 1111 1100 | …
^ ZERO!!!


So, as you can see, you‘re simply not testing things correctly. ◼

Does this mean that SHA512 only provides 511 bits of security?

No, as practically shown/proven above.

Does this prove that SHA512 is not a random oracle?

No, as practically shown/proven above.