Is it possible to break the SHA-512 hash algorithm?
Are there any successful attacks out there?
1
$\begingroup$
$\endgroup$
migrated from security.stackexchange.com Feb 1 '18 at 2:58
This question came from our site for information security professionals.
-
$\begingroup$ There's some info here: stackoverflow.com/questions/6776050/… In response to the question: anything is possible, if enough resources are provided. $\endgroup$ – baldPrussian Jan 31 '18 at 13:56
-
1$\begingroup$ This page may be of use: en.wikipedia.org/wiki/Hash_function_security_summary $\endgroup$ – jrtapsell Jan 31 '18 at 13:56
-
2$\begingroup$ @baldPrussian With the caveat that “enough resources” can mean “more energy than is available in our universe”. $\endgroup$ – Gilles 'SO- stop being evil' Jan 31 '18 at 20:39
-
2$\begingroup$ There are no known attacks against SHA-512, not against collision resistance and certainly not against first or second preimage resistance. But to give a better answer it would be helpful if you could expand on which security properties and usecase you have in mind. $\endgroup$ – Maeher Feb 1 '18 at 5:12
-
$\begingroup$ n a scenario where a human memorable password hashed with SHA-512 is available, it is likely possible to recover the password. Is that a break for you? It is not for a cryptographer. $\endgroup$ – fgrieu Feb 2 '18 at 7:56
3
$\begingroup$
$\endgroup$
Is it possible to break the SHA-512 hash algorithm?
We don't know. That is: it is impossible to prove that there aren't any attacks possible on SHA-512. But that doesn't mean that it can or cannot be broken.
Are there any successful attacks out there?
No, except length extension attacks, which are possible on any unaltered or extended Merkle-Damgard hash construction (SHA-1, MD5 and many others, but not SHA-3 / Keccak). If that's a problem depends on how the hash is used. In general cryptographic hashes are not considered broken just because they suffer from length extension attacks.
The SHA-3 competition was created to replace SHA-2 in case it would be broken in the same way as it's predecessor, SHA-1. However during the competition it became clear that SHA-2 in itself looks pretty secure.
answered Feb 1 '18 at 16:09
0
$\begingroup$
$\endgroup$
Since you are asking about breaking SHA-512 I will assume you want to ignore implementation specific vulnerabilities such as not enough rounds of hashing, no salt, common salt among users, reused salt etc. As it stands today, the only "practical" attack (that the general public knows of) against SHA-512 is brute-force. Hypothetically an attacker with sufficient computational power (depending on strength of the password this can vary from millions of dollars in hardware to an average laptop) an attacker can slowly guess every possible password until eventually finding a match. This attack can be very slow (millions of years if a single average consumer computer is used to crack a strong password) or only seconds if the password was "password".
There are other known attacks, but very few have proven practical (timing wise) and those that have prove to have such massive limitations in what they can do, that they do not truly break the algorithm. The following research conducted out of an Austrian University proves a practical collision attack on the truncated version of SHA-512. The collision attack is also only possible for very specific range of initial inputs. Between these two very strict requirements for the attack to function, it is not viewed as capable of breaking SHA-512.
Other attacks do exist but the vast majority have similar time complexities as a brute force attack and making them not much more useful than a brute force attack. A list can be found here under the Cryptanalysis and validation section.
Therefore, attacks marginally more effective than brute force attacks do exist for SHA-512 but are not yet even close to effective enough to consider the algorithm broken. SHA-512 is still a very secure, and trust worthy algorithm that can be safety used in programs currently in development.
-
1$\begingroup$ The question does not mention passwords anywhere. SHA-512 isn't even a password hashing function. $\endgroup$ – SAI Peregrinus Feb 1 '18 at 16:16
-
1$\begingroup$ I provided this answer on Security Stack Exchange where a.) People frequently refer to PBKDF2 SHA-2 family simply as SHA-256 and SHA-512 and b.) Based on the common assumption a, I answered this question based on passwords. I did not migrate this question hence the answer works under common Security Stack Exchange principles. If preferred, I can delete my answer since it was not meant for this site. $\endgroup$ – dFrancisco Feb 1 '18 at 16:25
