# Different inputs but able to generate consistent outputs across different SHA engines

Say I'm feeding in few thousand bits data (INPUT AAAA) into both SHA256 & SHA3 256 engines at the same time. (Both engines using different hashing architecture) and hence it will generate different 256-bits of output, lets say SHA256 generate ABCD while SHA3-256 generate EFGH.

I'm curious about if we can try to find the alternative input (INPUT BBBB) later that can generate the same HASH output like above (SHA256 generate ABCD & SHA3 256 generate EFGH).

• Sounds to me like you're after "collision resistance". Additionally, I'd like to note that you seem to use SHA2 and SHA3 in the same program to achieve domain separation, so I would like to note that it's perfectly possible to achieve domain separation while using the same hash function! E.g. SHA3(0 || INPUT AAAA) will be different from SHA3(1 || INPUT AAAA) – Ruben De Smet Jan 21 at 8:54
• @RubenDeSmet, if I interpret you correctly, you mean SHA2 can be out of the picture since the single SHA3 engine can achieve the domain separation by applying some kind of different seed numbers? – Pi-Turn Jan 21 at 9:04
• That's pretty much what I am saying indeed. FWIW, SHA2 does not necessarily need to be out of the picture (it's usually a bit faster than SHA3 in software), but there's no good reason to use both of them. – Ruben De Smet Jan 21 at 9:56
• Domain seperation, and it can be achieved with a fixed string on the beginning like SHA-3 does see suffix – kelalaka Jan 21 at 10:37

In short, this will be not be possible, even if we only use one secure hash function rather than two. You seem to be describing a sort of dual second-preimage attack where we need to find two inputs that clash over two separate hash functions.

A secure hash function will be resistant to such attacks. As such for either SHA2 & SHA3, it will not be possible to find another input that makes a desired output.

I believe that even SHA1 is only weak in terms of collision resistance. See here for further details.

• It's only a second pre-image attack if the input 1 "AAAA" is fixed (which is not entirely clear from the question). However, collision resistance still applies (for SHA-2 and -3 at least). – SEJPM Jan 21 at 9:14
• @SEJPM Thank you. I see what you mean, the wording of finding an alternative input later suggested to me that the initial input was fixed. – Modal Nest Jan 21 at 9:21
• @ModalNest, "A secure hash function will be resistant to such attacks. As such for either SHA2 & SHA3, it will not be possible to find another input that makes a desired output.", I always don't get why this is not possible to happen because the input size is always much larger than the output size. if your input is a 100,000 bits long meaning the permutation is easily larger than 2^256 bits long output. So it should have overlap with simple thinking... – Pi-Turn Jan 21 at 11:22
• @Pi-Turn The size of the input doesn't matter really. It's the mindboggling size of 256bits (in the case of preimage). Using some quick JS (so maybe wrong) but a 4GHz processor left running would take a number of years 54 digits long, assuming it ran one million hashes per clock cycle. Or 4000000000000000 hashes per second. – Modal Nest Jan 21 at 11:51
• @Pi-Turn There is an overlap I suppose in the sense that if you stored all 10k bit permutations, there would have to be $n$ collisions. However it's not feasible to do that. Even storing a single bit to represent every permutation of 256 bits would require more storage space than we have on earth. – Modal Nest Jan 21 at 14:58