1
$\begingroup$

My request is:
I need to know the source of constants (shift constants, IV, or S-Box) for the following algorithms:

  • SHA-1
  • SHA-2 (all sizes)
  • SHA-3

Examples:

  • BLOWFISH uses the hexadecimal values of PI.
  • SKEIN uses chosen constants from the output of running RJINDAEL in CTR mode on all zeros nonce and all zeros key and counter starting from 0 to one million.
  • CHACHA uses statements "expand 32-byte k" and "expand 16-byte k".
|improve this question
$\endgroup$
  • 3
    $\begingroup$ Did you try reading the specifications and the design documents? $\endgroup$ – Squeamish Ossifrage Jun 14 at 16:50
  • $\begingroup$ @Squeamish Ossifrage, i couldn't find all of the specifications. moreover, not all specifications add such information, for example GOST specification didn't specify the S-Box. The examples i have added are from cipher specification. $\endgroup$ – m.nasim Jun 14 at 16:53
  • $\begingroup$ This question is much too broad as is. Can you identify one cryptosystem at a time whose constants are apparently unexplained, and ask a question about that one? $\endgroup$ – Squeamish Ossifrage Jun 14 at 17:05
  • 1
    $\begingroup$ Note: ‘GOST’ is a large family of Russian standards, like ANSI, or ISO. Just as there are many cryptosystems specified in ANSI and ISO standards, there are many cryptosystems specified in GOST standards. So saying ‘GOST’ doesn't identify what cryptosystem you're talking about. $\endgroup$ – Squeamish Ossifrage Jun 14 at 17:08
  • 1
    $\begingroup$ Edited to remove twofish, rjindael, camellia. just keeping what @RichieFrame answered. The SHA family. $\endgroup$ – m.nasim Jun 15 at 21:38
1
$\begingroup$

Regarding the IVs and round constants of hash functions...

The question for SHA1 and SHA2 families have already been answered. Rotational constants were chosen by the designers to make the hash functions secure (or in the case of SHA1, not secure enough). Derivative hash functions such as SHA-224 and SHA-384 use different initial values which are simply the next primes on the list (9 through 16th). SHA-512/t uses different initial values based on the output of a slightly modified version of SHA-512 processing a short string.

SHA3 is a completely different construction. It has no initial values, the working state is simply all 0 bits. The round constants of SHA3 and Keccak are based on a linear feedback shift register, this takes up much less space in code vs hard coded numbers like those in SHA-2, and very cheap to implement in hardware. The rotational offsets for SHA3 and Keccak are a reordered set of triangular numbers modulo the lane size, which for SHA3 is 64-bits. This is also very cheap in both software and hardware, as it is simply a reordering of bits within the state.

|improve this answer
$\endgroup$
  • $\begingroup$ thank you @Richie Frame for your answer and referenced answers. After all, we are in front of two problems, either choose accurate constants which leads to questionable constants, or choose them randomly as in SKEIN and reduce diffusion. $\endgroup$ – m.nasim Jun 15 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.