# Pre-Image Resistance of repeated, patterned SHA2-256 digests

Suppose $$H = \operatorname{SHA2-256}$$.

Let $$H_1 = H(\text{“Alpha1”})$$.

Let $$H_2 = H(\text{“Alpha2”})$$.

Let $$H_N = H(\text{“AlphaN”})$$.

So all these digests are based off a common pre-image post-fixed with the index.

Question 1: Does knowing the values $$H_1, \dotsc, H_N$$ and the length of common pre-image substring "Alpha" leak any information about "Alpha"?

Question 2: Would double-hashing make any significant difference to pre-image security? E.g.: $$H_i = H(H(\text{“Alpha”} \mathbin\| i))$$

Question 1: Does knowing the values $$H_1, \dotsc, H_N$$ and the length of common pre-image substring "Alpha" leak any information about "Alpha"?

Only in the sense that it enables an adversary to test a guess for what the string might be. In particular, suppose the random variable $$X$$ has some probability distribution as far as you know. Knowing what $$H(X \mathbin\| i)$$ is narrows down the probability distribution on $$X$$ a great deal—possibly even to a unique value—and enables you to test a guess which you might not be able to do without knowing $$H(X \mathbin\| i)$$, but there's no way known to search for what $$X$$ might be cheaper than brute force.

Of course, if $$X$$ is simply (say) uniformly distributed among the English names for Greek letters—Alpha, Beta, Gamma, etc.—then the brute force search is already pretty cheap! Any security arises from a distribution with many more possibilities and much lower probabilities than $$1/24$$.

Question 2: Would double-hashing make any significant difference to pre-image security? E.g.: $$H_i = H(H(\text{“Alpha”} \mathbin\| i))$$

No; at most, it would slightly raise the false positive rate for a search.

• Suppose "Alpha" was really a 32byte secure cryptographic digest. Knowing it's 32bytes and knowing H_1..H_n, does it help me attack the pre-image? – Herman Schoenfeld Nov 13 '19 at 23:07
• It doesn't matter what function you used to compute it; what matters is the entropy of the probability distribution on values that could be in the place where you put “Alpha”. You could choose the value to be a bit string of 256 fair coin tosses without any cryptographic digest involved, and an adversary would essentially never guess what they were. You could use the beefiest, expensivest password hash like Argon2 with a zillion iterations and gigabytes of memory and umpteen CPU cores to decide that value, and it wouldn't mean much if the input to Argon2 is determined by a single coin toss. – Squeamish Ossifrage Nov 13 '19 at 23:11
• Is twice more work a significant difference? – fgrieu Dec 7 '20 at 7:38