4
$\begingroup$

Ferguson, Schneier and Kohno's Cryptography Engineering §5.4.2 describes a construction, $SHA_d\text-X(m)$, which is just $SHA\text-X(SHA\text-X(0^b\mathbin\|m))$ (where $SHA\text-X$ is any particular SHA-2 cipher, and $0^b$ represents a full input block of zero bits).

I understand that the second hash is necessary to prevent length-extension attacks.

What I don't understand, and cannot find adequate explanation for, is the rationale for zero-prefixing the inner message $m$. The book's hand-wavy explanation is that:

Prepending the message with a block of zeros makes it so that, unless something unusual happens, the first block input to the inner hash function in $h_d$ is different than the input to the outer hash function.

But that is as far as it goes to explain the zero block.

A related but distinct question, "Understanding double hash and 0 block prepending to mitigate lenght extension attacks," has a partial answer from fgrieu:

If the $0^b$ in the question's construction was absent, as in $H'(m)=H(H(m))$, we'd have the property: $\forall m,H'(H(m))=H(H'(m))$. We can construct some (largely artificial) protocols which would be secure for $H$, but are insecure for $H'$ due to that property; and correspondingly, that property makes some security proofs hairy, impossible, or weaker. With $H'(m)=H(H(0^b\mathbin\|m))$, that or similar properties do not hold, which is good for simpler/stronger security proofs.

What protocols would be insecure for $SHA_d\text-X'(m)=SHA\text-X(SHA\text-X(m))$? (To be clear: such a $SHA_d\text-256'$ construction would not be susceptible to length-extension attacks, right?) Does the difference matter for any "real-world" protocols that use the $SHA_d$ construction today?

Is there a good name for this property ($\forall m,H'(H(m))=H(H'(m))$) that I can search the literature for?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.