I am looking into building a merkle tree algorithm and I need to know if SHA256 is resistant to second preimage attack.


1 Answer 1


SHA-256 has no known collision attack and has no known second pre-image attack and has no known pre-image attack.

There was a claim Has SHA256 been broken by Treadwell Stanton DuPont? but is has already debunked.

Currently, we have generic attacks: $2^{256}$ pre-image resistance, $2^{256}$ secondary pre-image resistance and $2^{128}$ collision resistance. Collision resistance is lower due to the birthday attack. The academical attacks are on reduced rounds, therefore not practical, yet.

Note per comment: It is not SHA-256 or any other Cryptographic hash's weakness. It is a problem with hash trees that enables to find secondary pre-images and it can be mitigated with domain separation as mentioned in rfc6992. You can also see this problem in this post;

  • $\begingroup$ Thank you. Furthermore do I have to take into account that leaf nodes and the internal nodes have different hashes like for example it is done for sha-1?As explained here crypto.stackexchange.com/questions/2097/… $\endgroup$
    – Hoistas
    Sep 19, 2019 at 6:34
  • $\begingroup$ are you asking adding 1 and 0 for domain separation? $\endgroup$
    – kelalaka
    Sep 19, 2019 at 6:57
  • $\begingroup$ Yes I am asking about adding data to make the leafs and the nodes different. Do we have to do that for sha256? $\endgroup$
    – Hoistas
    Sep 19, 2019 at 9:47
  • 1
    $\begingroup$ That is a different question and you can find the answer here $\endgroup$
    – kelalaka
    Sep 19, 2019 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.