With SHA-2 for hashing, using only the first 128 bits to create a 128 bit hash, what kind of attack would this be vulnerable to and why?

Since 128 bit encryption keys are secure, shouldn't a 128 bit hash also be secure?

Would this be insecure against a brute force attack?

  • 4
    $\begingroup$ This sounds like a homework question. Think of the birthday problem, for which situation would the birthday problem be an issue? How many bits of security would remain if the birthday problem applies? $\endgroup$
    – Maarten Bodewes
    Apr 13, 2020 at 18:35
  • 4
    $\begingroup$ There was a question about What are the consequences of removing a single byte from a sha256 hash?. The same problem with different values. plug and play. $\endgroup$
    – kelalaka
    Apr 13, 2020 at 18:46
  • 1
    $\begingroup$ Sometime, birthday attack is considered brute force. But if the problem explicitly asks about brute force attack versus birthday attack, then likely it considers brute force (preimage) attack as: try messages until hitting a given target hash. What is the likelihood of success of that strategy? Is it high enough that it is not doomed in practice? How does it compare to a birthday attack (see my Birthday problem for cryptographic hashing, 101). $\endgroup$
    – fgrieu
    Apr 15, 2020 at 4:29
  • 1
    $\begingroup$ The classic reference for implementation of birthday attacks using a practical amount of memory is Paul C. van Oorschot and Michael J. Wiener, Parallel Collision Search with Cryptanalytic Applications, in Journal of Cryptology, 1999. $\endgroup$
    – fgrieu
    Apr 15, 2020 at 14:10
  • 2
    $\begingroup$ Birthday attack = collision search. See section 4.1 with "small" = 1. $\endgroup$
    – fgrieu
    Apr 15, 2020 at 14:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.