# Difference between SHA 512, SHA 512 Half, SHA 256

I was trying to create a python wrapper for RIPPLE crypto currency, and i ran into SHA 512 half which i have no idea or reverse googled it to no avail. Can someone help me understand the difference. Currently i am assuming its any 256 bits of SHA512. RIPPLE Address Encoding • By SHA-512 half, do you mean SHA-512/256, perhaps? That is SHA-512 with different initial constants, truncated to 256 bits. Or maybe you just mean regular SHA-512 truncated to 256 bits (which is basically the same, security-wise). As for SHA-256, it is a different hash using 32-bit operations instead of 64-bit operations, and having an internal state of 256 bits instead of 512. It also takes input blocks of half the size.
– forest
Feb 14, 2018 at 14:04
– Tom K.
Feb 14, 2018 at 14:17
• @TomK. This was just pure speculation on my part, along with a tiny bit of extra info, so it would be ill-fitting for an entire answer. Not to mention the question is likely to be closed anyway (already has 4 close votes).
– forest
Feb 14, 2018 at 14:18
• @forest i'm not sure either. I know SHA-256 and SHA-512, but i cannot figure out anything about SHA-512 Half, i'm also assuming its truncated 256 bits of SHA-512, but i'm not certain about it Feb 15, 2018 at 4:15
• I don't know either. It's either going to be truncated SHA-512, or SHA-512/256 (which is basically truncated SHA-512 with different initial values in order to make it technically a different hash). Regardless, the security will be the same. I would guess the former, as otherwise it would probably be called SHA-512/256. Do you have sample input and output to test it?
– forest
Feb 15, 2018 at 4:21

SHA-256 is a function with up to $2^{64}$ bits of input, which are broken into 512-bit blocks, and with a 256-bit output. It is conjectured to be collision-, preimage-, and second-preimage resistant at (resp.) 128-, 256-, and 256-bit security levels, but it has the unfortunate property that given $\operatorname{SHA-256}(m)$ but not $m$, it is relatively easy to compute $\operatorname{SHA-256}(m \mathbin\Vert p \mathbin\Vert m')$ for an arbitrary suffix $m'$, where $p$ depends only on the length of $m$.
SHA-512 is a function with up to $2^{128}$ bits of input, which are broken into 1024-bit blocks, and with a 512-bit output. It is conjectured to be collision-, preimage-, and second-preimage resistant at (resp.) 256-, 512-, and 512-bit security levels, but it has the unfortunate property that given $\operatorname{SHA-512}(m)$ but not $m$, it is relatively easy to compute $\operatorname{SHA-512}(m \mathbin\Vert p \mathbin\Vert m')$ for an arbitrary suffix $m'$, where $p$ depends only on the length of $m$.
‘SHA-512half’ is probably SHA-512 truncated to 256 bits. Thus it takes up to $2^{128}$ bits of input, broken into 512-bit blocks, and yields a 256-bit output. Like SHA-256, it is conjectured to be collision-, preimage-, and second-preimage resistant at (resp.) 128-, 256-, and 256-bit security levels. Unlike SHA-256 or SHA-512, to compute $\operatorname{SHA-512half}(m \mathbin\Vert m')$ for any $m'$ (whether with the padding $p$ or not) given only $\operatorname{SHA-512half}(m)$ and not $m$, it is conjectured to cost at least an expected $2^{255}$ SHA-512 computations.