5
$\begingroup$

Does knowledge of SHA256(secret) and SHA256(secret ∥ known constant) give any more information about the secret than just knowledge of SHA256(secret)?

$\endgroup$
  • 1
    $\begingroup$ What do you mean by 'is knowledge of'? $\endgroup$ – Andrew Fan Jan 24 '19 at 18:30
  • 1
    $\begingroup$ What is your goal? "Any more information about" could range from "anything more than 0 bits of information" to "some information to break the security". Precise definitions matter a lot. Also, the term "secret" doesn't really describe the kind of input: A low entropy password or a cryptographic key? And finally: Are you interested in scientific answers or practical applications? From the short question, I don't know what you want to know, and it could be both. $\endgroup$ – tylo 20 hours ago
  • $\begingroup$ Hopefully there's now consensus on a reading of the question. The OP seems gone, thus we might never know. For reference, the original question. $\endgroup$ – fgrieu 3 hours ago
4
$\begingroup$

In the first case; the attacker has this knowledge

  • $\operatorname{SHA256}$
  • $x = \operatorname{SHA256}(\text{secret})$

While brute-forcing this hash value $x$, there is one problem. One cannot determine whether this is the pre-image or it is a second pre-image. For password cracking, that is not really important since you find a valid password for the target. For your case, assuming the secret has to be determined exactly, there is no way for the attacker. Actually, finding more than one break the collision property of SHA256, see in Fgrieu's answer. Therefore, it is hard to find more than one.

In the second case; the attacker has

  • $\operatorname{SHA256}$
  • $x = \operatorname{SHA256}(\text{secret})$
  • $\text{the known constant}$
  • $y = \operatorname{SHA256}(\text{secret}\mathbin\|\text{the known constant})$

This additional knowledge gives the attacker extra information that can be exploited. While brute-forcing to find the secret, this time the attacker has a new mechanism to distinguish the second pre-images from the secret. Given a secret candidate $candidate_s$ check;

$$ y = \operatorname{SHA256}(candidate_s\mathbin\|\text{the known constant})$$

Apart from the pre-image, the probability of this equality is negligible since we expect that SHA-256 has collision resistance.

As a result, this gives extra information about the secret that can be exploited.

Side note: if the entropy of the $secret$ is larger than 128-bit, it is not possible to execute brute-force on-the secret.

$\endgroup$
  • $\begingroup$ To be honest, I think this answer does not address the question as it was intended. But the reason for that is, the question does not state it's goal. My guess would be, the questioner wants to know if this can be used to break the hash - which it can't (in the practical sense). $\endgroup$ – tylo 20 hours ago
  • 1
    $\begingroup$ @kelalaka: I moved my comments in my answer, using your notation. $\endgroup$ – fgrieu 4 hours ago
1
$\begingroup$

TLDR - Yes, you should avoid using SHA256(secret||constant).

Detailed explanation

Hash functions based on the Merkle–Damgård construction (SHA1, SHA2 MD5) are vulnerable to a length extension attack, while SHA3 is not vulnerable to this attack.

You have m=message, K=secret and applying SHA256 to K||m, as SHA256 tackles blocks iteratively indeed it will hash m’ = m || Padding, where Padding is data filled in the last block by a hash function.

The main idea of this attack is adding new data and padding to the end:

m’ = m || Padding || NewData || NewPadding

Like a consequence, it will allow generating a valid signature without knowing a secret key.

It means next: if an attacker knows SHA256(secret||constant) he can compute SHA256(secret||constant||some_other_data) in easy way. Take a look at the example with HTTP request in Wikipedia article (link above). It's the second case described by @kelalaka

Safe usage of (secret||constant)

  • Double hashing H' = H(K || H(K || m)), where K is a secret data

  • Adding the secret data to the end before hashing H' = H(K || Padding || m || K )

  • Using an additional hash function inside of Merkle–Damgård construction, H' = f(H(m)), it's a theoretical statement, I've checked it, but it should work fine.

  • Concatenation of the secret with each message block: something like HMAC or just use HMAC(data, secret) instead - IMO, it's the easiest way

$\endgroup$
  • 1
    $\begingroup$ it will allow generating a valid signature - That's not a signature, it's an attempt at a MAC. The question does not specify that they are inquiring about this construction in the context of a MAC. They asked if it leaks any information about the secret. Whether or not that's what they should be asking about is a different question, but as-is this answer doesn't appear to address the question that was asked. $\endgroup$ – Ella Rose Feb 7 '19 at 1:19
1
$\begingroup$

As stated in other answers, yes revealing $y=\operatorname{SHA-256}(\mathrm{secret}\mathbin\|\mathrm{known\_constant})$ in addition to $x=\operatorname{SHA-256}(\mathrm{secret})$ gives extra information about $\mathrm{secret}$. That has both theoretical and practical implications.

From a theoretical standpoint, that's very likely to reduce the number of possible values of $\mathrm{secret}$, if $\mathrm{secret}$ is more than about 256-bit.

From a practical standpoint: the additional revelation of $y$ does not reveal $\mathrm{secret}$, nor makes it practically easier finding it¹. There still can be practical consequences. Here is one making use of the length-extension property of Merkle–Damgård hashes.

With knowledge of $y$, an adversary knowing the length of $\mathrm{secret}$ can compute $\operatorname{SHA-256}(\mathrm{secret}\mathbin\|\mathrm{known\_constant}\mathbin\|m)$ for $m$ largely chosen by the attacker (except for the beginning of $m$). Absent $y$ and with $\mathrm{secret}$ unguessable, that would be impossible for the overwhelming majority of $\mathrm{known\_constant}$. Further, if the adversary can choose $\mathrm{known\_constant}$, s/he can do so in a manner that removes any constraint on $m$.


¹ Argument: when and if we find $\mathrm{candidate}$ such that $x=\operatorname{SHA-256}(\mathrm{candidate})$, we are practically sure that $\mathrm{candidate}=\mathrm{secret}$, because any alternate hypothesis would imply that (together with the entity that came with $x$ in the first place) we have broken collision-resistance of $\operatorname{SHA-256}$; and we reject that implication. Also, as far as we know, the best method to find such $\mathrm{candidate}$ is by trial and error among likely candidates, and checking a $\mathrm{candidate}$ on the basis of $y$ alone is not faster than on the basis of $x$ alone (rather, slower if $\mathrm{known\_constant}$ induces any more round); and the only known way to combine the two is slower.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy