4
$\begingroup$

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would this cause? Would it be easier to find collisions, preimages, etc? Would it be possible to insert backdoors?

So far, I've only found one example, as specified here (Using SHA-256 with different initial hash value):

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.

Are there any other examples of potential weaknesses/attacks that would ensue if I allow the attacker to choose arbitrary IVs for the SHA256 hash function?

Improve this question
$\endgroup$
2
  • $\begingroup$ If you're looking for a way to create new hash functions, then you have options other than inventing your own algorithm. Some newer hash algorithms have a "context", "domain", or "personalization" string as an optional parameter, specifically for that purpose. (So there is no issue with using the same or related input with two instances of the hash algorithm with different context strings. Nor any relation in the corresponding outputs.) Salting gets you something kind of similar. Implementations of these things sometimes sub IV values as an optimization. (But the IV is not totally arbitrary) $\endgroup$
    – Future Security
    Mar 28, 2020 at 22:03
  • $\begingroup$ Malicious SHA-1 "We show that systems using 'custom' versions of SHA-1 may include backdoors exploitable by the designers. Such custom versions of cryptographic standards are typically found in proprietary systems as a way to personalize the cryptography for a given customer" They claim "To third party analysis, malicious SHA-1 remains as strong as the original SHA-1: the backdoor is 'undiscoverable', it can only be exploited by the [party choosing the IV]." You can probably pick IVs that ARE exploitable by everyone. SHA-1 is bad. $\endgroup$
    – Future Security
    Mar 28, 2020 at 23:00

1 Answer 1

Reset to default
4
$\begingroup$

Would it be easier to find collisions, preimages, etc?

First note that if you can find preimages for a compressing function (like a hash) you can also find collisions. This means if we can't find collisions, then we also can't find preimages and thelike.

Now, the scenario you are describing is called a "freestart collision attack". Freestart collisions are one of the first signs that a hash functions has a serious flaw, e.g. a freestart collision was found for SHA-1 a couple of years before the full collision. Such a collision would utterly destroy our current faith in SHA-256 and is thus unlikely to be found.

Also note that the quoted passage talks about a variant of SHA-256 that removes the length padding to describe an attack. This attack is prevented by the length padding (and is the main reason why it's there).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.