Is there any Corelation between the SHA256 and SHA512 hash of the same data ?

  • 3
    $\begingroup$ $$\texttt{NO}$$ $\endgroup$
    – kelalaka
    Mar 29, 2019 at 19:15
  • $\begingroup$ Detectable correlation? None known, and we assume none will be found anytime soon. There's an indirect one from that they use the same underlying algorithm design, which means any hypothetical biases should have similar properties, but they are also configured differently, with different constants. There should be no observable correlation in the output for as long as the algorithms remain secure. $\endgroup$
    – Natanael
    Mar 30, 2019 at 0:57

1 Answer 1



Knowing $h = \operatorname{SHA-256}(m)$ without $m$ doesn't help you to find $h' = \operatorname{SHA-512}(m)$, or vice versa, except insofar as you can use $h$ to test a guess $m^*$ for what $m$ might be, by checking $$h \stackrel?= \operatorname{SHA-256}(m^*).$$

The same goes for all of the SHA-2 functions {SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256}. It also goes for the fixed-length SHA-3 functions {SHA3-224, SHA3-256, SHA3-384, SHA3-512}.

Note: The extendable-output SHA-3 functions SHAKE128 and SHAKE256 have the property that SHAKE128-$n$ and SHAKE128-$m$ share a common prefix—in other words, SHAKE128 and SHAKE256 produce infinite-length outputs for any input and you just use a finite prefix of the length you requested. However, they are otherwise independent of the SHA-2 and fixed-length SHA-3 functions, and of the related SHA-3 constructions KMAC, TupleHash, and ParallelHash.

You can make your own family of independent functions in the privacy of your own living room by picking a fixed-length prefix $p$ in some set like {foo, bar, baz, qux, zot} and using, say, $m \mapsto \operatorname{SHAKE128}(p \mathbin\| m)$ or $m \mapsto \operatorname{SHA-512/256}(p \mathbin\| m)$; for each distinct $p$, this can be modeled as an independent uniform random function as in a random oracle, as long as you always use a prefix.*†

* Note that if you use $H_p\colon m \mapsto \operatorname{SHA-256}(p \mathbin\| m)$, you have the property that knowledge of $H_p(m)$ lets you compute $H_p(\operatorname{pad}(m) \mathbin\| m')$ for any suffix $m'$, which is quite improbable for a uniform random function. This is called a length extension attack. The SHA-3 functions dispense with this property, as do SHA-512/224 and SHA-512/256.

Actually the set of prefixes need not be fixed-length—it is sufficient that it be prefix-free, meaning that if $p \ne p'$ are in the set of possible prefixes, then neither one is a prefix of the other. For instance, length-encoded tags like 3 foo, 4 quux, 11 hello world would work too, as long as the length is encoded uniquely.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.