0
$\begingroup$

Say I'm feeding in few thousand bits data (INPUT AAAA) into both SHA256 & SHA3 256 engines at the same time. (Both engines using different hashing architecture) and hence it will generate different 256-bits of output, lets say SHA256 generate ABCD while SHA3-256 generate EFGH.

I'm curious about if we can try to find the alternative input (INPUT BBBB) later that can generate the same HASH output like above (SHA256 generate ABCD & SHA3 256 generate EFGH).

$\endgroup$
4
  • 2
    $\begingroup$ Sounds to me like you're after "collision resistance". Additionally, I'd like to note that you seem to use SHA2 and SHA3 in the same program to achieve domain separation, so I would like to note that it's perfectly possible to achieve domain separation while using the same hash function! E.g. SHA3(0 || INPUT AAAA) will be different from SHA3(1 || INPUT AAAA) $\endgroup$ – Ruben De Smet Jan 21 at 8:54
  • $\begingroup$ @RubenDeSmet, if I interpret you correctly, you mean SHA2 can be out of the picture since the single SHA3 engine can achieve the domain separation by applying some kind of different seed numbers? $\endgroup$ – Pi-Turn Jan 21 at 9:04
  • 2
    $\begingroup$ That's pretty much what I am saying indeed. FWIW, SHA2 does not necessarily need to be out of the picture (it's usually a bit faster than SHA3 in software), but there's no good reason to use both of them. $\endgroup$ – Ruben De Smet Jan 21 at 9:56
  • 1
    $\begingroup$ Domain seperation, and it can be achieved with a fixed string on the beginning like SHA-3 does see suffix $\endgroup$ – kelalaka Jan 21 at 10:37
2
$\begingroup$

In short, this will be not be possible, even if we only use one secure hash function rather than two. You seem to be describing a sort of dual second-preimage attack where we need to find two inputs that clash over two separate hash functions.

A secure hash function will be resistant to such attacks. As such for either SHA2 & SHA3, it will not be possible to find another input that makes a desired output.

I believe that even SHA1 is only weak in terms of collision resistance. See here for further details.

$\endgroup$
9
  • 1
    $\begingroup$ It's only a second pre-image attack if the input 1 "AAAA" is fixed (which is not entirely clear from the question). However, collision resistance still applies (for SHA-2 and -3 at least). $\endgroup$ – SEJPM Jan 21 at 9:14
  • $\begingroup$ @SEJPM Thank you. I see what you mean, the wording of finding an alternative input later suggested to me that the initial input was fixed. $\endgroup$ – Modal Nest Jan 21 at 9:21
  • $\begingroup$ @ModalNest, "A secure hash function will be resistant to such attacks. As such for either SHA2 & SHA3, it will not be possible to find another input that makes a desired output.", I always don't get why this is not possible to happen because the input size is always much larger than the output size. if your input is a 100,000 bits long meaning the permutation is easily larger than 2^256 bits long output. So it should have overlap with simple thinking... $\endgroup$ – Pi-Turn Jan 21 at 11:22
  • 1
    $\begingroup$ @Pi-Turn The size of the input doesn't matter really. It's the mindboggling size of 256bits (in the case of preimage). Using some quick JS (so maybe wrong) but a 4GHz processor left running would take a number of years 54 digits long, assuming it ran one million hashes per clock cycle. Or 4000000000000000 hashes per second. $\endgroup$ – Modal Nest Jan 21 at 11:51
  • 1
    $\begingroup$ @Pi-Turn There is an overlap I suppose in the sense that if you stored all 10k bit permutations, there would have to be $n$ collisions. However it's not feasible to do that. Even storing a single bit to represent every permutation of 256 bits would require more storage space than we have on earth. $\endgroup$ – Modal Nest Jan 21 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.