I'm reading this paper: fips180-4-draft-aug2014

I'm on page 23 where they have two values for SHA-256: T1 and T2. While I understand the operations done, I don't understand the bigger picture. Why do we need T1 and T2 in this case? What do the values T1 and T2 represent?

The paper defines it as "T Temporary w-bit word used in the hash computation." But why go through so many shifts and other operations?


1 Answer 1


It is in the part of the internal block cipher of SHA2 that has 64 or 80 rounds depending on the mode, SHA256 has 64, SHA512 has 80 rounds.

the picture of Wikipedia SHA2 page

Why do we need T1 and T2 in this case?

Except the $T_1$ and $T_2$, everything is linear. In the picture, they are the blue and red word additions ($\color{red}{\boxplus}$). Being only linear is not a good idea in Cryptography. It is easy to attack since one can setup linear equations and solve by Gaussian Elimination. Nonlinearity is necessary but not sufficient. It uses the confusion and diffusion paradigm with many rounds where the key of the block cipher is the message.

What do the values T1 and T2 represent?

Values changes according to inputs but the function definitions are fixed.

But why go through so many shifts and other operations?

You can consider the shift operations as the diffusion part of the design, in order to affect each output bits with many key bits and many input bits in lesser rounds.

Of course, all of these above cannot claim that SHA256 is secure. It is designed to be secure with the previous knowledge about hash designs. Yet, SHA2 is not broken even theoretically i.e. even one bit less than the classic generic attacks

  • pre-image attack that has $\mathcal{O}(2^{256})$
  • second pre-image attack $\mathcal{O}(2^{256})$
  • collision attack $\mathcal{O}(2^{128})$ due to the generic birthday attack.

Best known attacks are on the reduced rounds like preimage attack for 42 of 64 rounds with a $2^{248.4}$ complexity.

Even it is theoretically broken, it might not have a practical effect. For example, a full round pre-image attack with $2^{200}$ cannot be used in practice.

The previous hash of NIST SHA-1 is broken and the first forge is generated, see list of attacks on SHA-1. For SHA-2, the time will show. As said Attacks always get better; they never get worse.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.