3
$\begingroup$

I was trying to create a python wrapper for RIPPLE crypto currency, and i ran into SHA 512 half which i have no idea or reverse googled it to no avail. Can someone help me understand the difference. Currently i am assuming its any 256 bits of SHA512. RIPPLE Address Encoding enter image description here

$\endgroup$
6
  • 3
    $\begingroup$ By SHA-512 half, do you mean SHA-512/256, perhaps? That is SHA-512 with different initial constants, truncated to 256 bits. Or maybe you just mean regular SHA-512 truncated to 256 bits (which is basically the same, security-wise). As for SHA-256, it is a different hash using 32-bit operations instead of 64-bit operations, and having an internal state of 256 bits instead of 512. It also takes input blocks of half the size. $\endgroup$
    – forest
    Feb 14, 2018 at 14:04
  • $\begingroup$ @forest Aren't we supposed to not answer in comments? :P $\endgroup$
    – Tom K.
    Feb 14, 2018 at 14:17
  • $\begingroup$ @TomK. This was just pure speculation on my part, along with a tiny bit of extra info, so it would be ill-fitting for an entire answer. Not to mention the question is likely to be closed anyway (already has 4 close votes). $\endgroup$
    – forest
    Feb 14, 2018 at 14:18
  • $\begingroup$ @forest i'm not sure either. I know SHA-256 and SHA-512, but i cannot figure out anything about SHA-512 Half, i'm also assuming its truncated 256 bits of SHA-512, but i'm not certain about it $\endgroup$ Feb 15, 2018 at 4:15
  • $\begingroup$ I don't know either. It's either going to be truncated SHA-512, or SHA-512/256 (which is basically truncated SHA-512 with different initial values in order to make it technically a different hash). Regardless, the security will be the same. I would guess the former, as otherwise it would probably be called SHA-512/256. Do you have sample input and output to test it? $\endgroup$
    – forest
    Feb 15, 2018 at 4:21

1 Answer 1

9
$\begingroup$

SHA-256 is a function with up to $2^{64}$ bits of input, which are broken into 512-bit blocks, and with a 256-bit output. It is conjectured to be collision-, preimage-, and second-preimage resistant at (resp.) 128-, 256-, and 256-bit security levels, but it has the unfortunate property that given $\operatorname{SHA-256}(m)$ but not $m$, it is relatively easy to compute $\operatorname{SHA-256}(m \mathbin\Vert p \mathbin\Vert m')$ for an arbitrary suffix $m'$, where $p$ depends only on the length of $m$.

SHA-512 is a function with up to $2^{128}$ bits of input, which are broken into 1024-bit blocks, and with a 512-bit output. It is conjectured to be collision-, preimage-, and second-preimage resistant at (resp.) 256-, 512-, and 512-bit security levels, but it has the unfortunate property that given $\operatorname{SHA-512}(m)$ but not $m$, it is relatively easy to compute $\operatorname{SHA-512}(m \mathbin\Vert p \mathbin\Vert m')$ for an arbitrary suffix $m'$, where $p$ depends only on the length of $m$.

‘SHA-512half’ is probably SHA-512 truncated to 256 bits. Thus it takes up to $2^{128}$ bits of input, broken into 512-bit blocks, and yields a 256-bit output. Like SHA-256, it is conjectured to be collision-, preimage-, and second-preimage resistant at (resp.) 128-, 256-, and 256-bit security levels. Unlike SHA-256 or SHA-512, to compute $\operatorname{SHA-512half}(m \mathbin\Vert m')$ for any $m'$ (whether with the padding $p$ or not) given only $\operatorname{SHA-512half}(m)$ and not $m$, it is conjectured to cost at least an expected $2^{255}$ SHA-512 computations.

The functions SHA-256 and SHA-512 resemble independent uniform random choices of function, except for the length extension property, whereas SHA-512 and SHA-512half are obviously not independent since SHA-512half is just half the output of SHA-512 on the same input. SHA-512/256 is like SHA-512half, except it it uses different initialization vectors and thus resembles another independent uniform random choice of function.

$\endgroup$
1
  • $\begingroup$ Just here to confirm that yes, it is the first 256 bits of the SHA-512 output. You can erase "probably". $\endgroup$ Jan 14, 2020 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.