There's a black box that's basically SHA-1, except that the constants (h0, h1,...,h4) are secret. We can pass it arbitrary inputs and get the corresponding outputs.
Given this, is it possible to recover the constants used?
$\begingroup$
$\endgroup$
2
-
2$\begingroup$ If I'm understanding the values correctly, they are the initial Merkle-Damgard chaining values. This turns the question into "given oracle access to $H(k\| \cdot)$ can we recover $k$" to which the answer is "no" because the SHA1 compression function is still enough of a PRF to not allow this. $\endgroup$– SEJPM ♦Jul 31 '19 at 14:19
-
1$\begingroup$ SHA-1's final step--adding the previous block state back in--is what prevents this. If it weren't for that step, you could run the SHA-1 algorithm in reverse with your data block to get the input value. (In other words, doing a SHACAL-1 block decryption.) $\endgroup$– MyriaJul 31 '19 at 18:47
Add a comment
|
$\begingroup$
$\endgroup$
No. If it were, that would demonstrate a PRF distinguisher against the SHA-1 compression function, which would be an astonishing result showing that SHA-1 is far more broken than anyone has ever seriously anticipated.
answered Aug 28 '19 at 1:23