# Recover secret SHA-1 constants given Oracle

There's a black box that's basically SHA-1, except that the constants (h0, h1,...,h4) are secret. We can pass it arbitrary inputs and get the corresponding outputs.

Given this, is it possible to recover the constants used?

• If I'm understanding the values correctly, they are the initial Merkle-Damgard chaining values. This turns the question into "given oracle access to $H(k\| \cdot)$ can we recover $k$" to which the answer is "no" because the SHA1 compression function is still enough of a PRF to not allow this. – SEJPM Jul 31 '19 at 14:19
• SHA-1's final step--adding the previous block state back in--is what prevents this. If it weren't for that step, you could run the SHA-1 algorithm in reverse with your data block to get the input value. (In other words, doing a SHACAL-1 block decryption.) – Myria Jul 31 '19 at 18:47