Ferguson, Schneier and Kohno's Cryptography Engineering §5.4.2 describes a construction, $SHA_d\text-X(m)$, which is just $SHA\text-X(SHA\text-X(0^b\mathbin\|m))$ (where $SHA\text-X$ is any particular SHA-2 cipher, and $0^b$ represents a full input block of zero bits).

I understand that the second hash is necessary to prevent length-extension attacks.

What I don't understand, and cannot find adequate explanation for, is the rationale for zero-prefixing the inner message $m$. The book's hand-wavy explanation is that:

Prepending the message with a block of zeros makes it so that, unless something unusual happens, the first block input to the inner hash function in $h_d$ is different than the input to the outer hash function.

But that is as far as it goes to explain the zero block.

A related but distinct question, "Understanding double hash and 0 block prepending to mitigate lenght extension attacks," has a partial answer from fgrieu:

If the $0^b$ in the question's construction was absent, as in $H'(m)=H(H(m))$, we'd have the property: $\forall m,H'(H(m))=H(H'(m))$. We can construct some (largely artificial) protocols which would be secure for $H$, but are insecure for $H'$ due to that property; and correspondingly, that property makes some security proofs hairy, impossible, or weaker. With $H'(m)=H(H(0^b\mathbin\|m))$, that or similar properties do not hold, which is good for simpler/stronger security proofs.

What protocols would be insecure for $SHA_d\text-X'(m)=SHA\text-X(SHA\text-X(m))$? (To be clear: such a $SHA_d\text-256'$ construction would not be susceptible to length-extension attacks, right?) Does the difference matter for any "real-world" protocols that use the $SHA_d$ construction today?

Is there a good name for this property ($\forall m,H'(H(m))=H(H'(m))$) that I can search the literature for?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.