Suppose the attacker knows $X, Z$ such that

$H(X || Y) = Z$

If bit-length(Y) < 60 then a brute force attack is possible.

What if bit-length(Z) = 256 (such as in SHA-256), bit-length(X) = 128, or bit-length(Y) = 256? Are there any published paper with results/experiments with SHA-256/512 in full or reduced rounds? Are there specific known attack techniques?

  • 6
    $\begingroup$ I'm pretty confident there is nothing out there allowing a preimage attack of this kind on SHA-256 with full rounds. $\endgroup$ – fgrieu Feb 23 '13 at 16:46
  • $\begingroup$ Regarding the brute force attack, the bitcoin network could brute-force more than 60 bit quite fast (today - the question is 4 years old): Assuming $5 \cdot 10^{18}$ hashes per second, it would take the bitcoin network $\approx 0.23$ sec for a full search over $60$ bit. $\endgroup$ – tylo Jun 19 '17 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.