There's a black box that's basically SHA-1, except that the constants (h0, h1,...,h4) are secret. We can pass it arbitrary inputs and get the corresponding outputs.

Given this, is it possible to recover the constants used?

  • 2
    $\begingroup$ If I'm understanding the values correctly, they are the initial Merkle-Damgard chaining values. This turns the question into "given oracle access to $H(k\| \cdot)$ can we recover $k$" to which the answer is "no" because the SHA1 compression function is still enough of a PRF to not allow this. $\endgroup$
    – SEJPM
    Jul 31 '19 at 14:19
  • 1
    $\begingroup$ SHA-1's final step--adding the previous block state back in--is what prevents this. If it weren't for that step, you could run the SHA-1 algorithm in reverse with your data block to get the input value. (In other words, doing a SHACAL-1 block decryption.) $\endgroup$
    – Myria
    Jul 31 '19 at 18:47

No. If it were, that would demonstrate a PRF distinguisher against the SHA-1 compression function, which would be an astonishing result showing that SHA-1 is far more broken than anyone has ever seriously anticipated.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.