Let $M$ denote a message.

Choose (arbitrarily or randomly) five different sequences of bits (their lengths are allowed to be arbitrary, assuming that our HMAC construction will not exceed the maximum input length for SHA-256). Denote them by $S_i$. For example, we can simply choose “0”, “00”, “000”, “0000” and “00000”.

Consider the following function: $$\begin{array}{l} H(M) = H_5 \mathbin\Vert H_6,\\ \end{array}$$

where $$\begin{array}{l} H_1 = \text{SHA-256}(M),\\ H_2 = \text{HMAC-SHA-256}(M, H_1 \mathbin\Vert S_1),\\ H_3 = \text{HMAC-SHA-256}(M, H_2 \mathbin\Vert S_2),\\ H_4 = \text{HMAC-SHA-256}(M, H_3 \mathbin\Vert S_3),\\ H_5 = \text{HMAC-SHA-256}(M, H_1 \mathbin\Vert H_3 \mathbin\Vert S_4),\\ H_6 = \text{HMAC-SHA-256}(M, H_2 \mathbin\Vert H_4 \mathbin\Vert S_5)\\ \end{array}$$

(assuming that $M$ is the message for HMAC, and the part that ends with $S_i$ is the key).

Is $H(M)$ weaker than $\text{SHA-512}(M)$? If yes, in what aspects?

  • $\begingroup$ "maximum message length of SHA-256" $\endgroup$
    – Elias
    Feb 16 '18 at 8:34
  • $\begingroup$ Analysis of full designs is off-topic on this website. Could you maybe formulate a broader question? $\endgroup$
    – Elias
    Feb 16 '18 at 8:46
  • $\begingroup$ @Elias: I meant maximum input length for SHA-256 (as described e.g. here) $\endgroup$ Feb 16 '18 at 9:01
  • 4
    $\begingroup$ I would say this probably depends heavily on the threat model, if it is collision resistance then SHA-512 would be far superior $\endgroup$ Feb 16 '18 at 12:07
  • 1
    $\begingroup$ The question comes down to state, I think. The internal state of SHA-256 is half that of SHA-512 and concatenating two different hashes that depend on half the state doesn't necessarily double the final security of the hash function. So it would be easiest to disprove that doubling the output relying on SHA-256 doesn't double the security provided by the state. If the state is effectively doubled then it comes down to comparing the complexity of the hash-construct with SHA-512, but I'm afraid that will be much harder (I'm freewheeling a bit here). $\endgroup$
    – Maarten Bodewes
    Feb 16 '18 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.