0
$\begingroup$

I found only the abstract and tables of this paper https://dl.acm.org/doi/abs/10.1145/3409501.3409513

From the abstract

In this paper, the researchers proved that the modified SHA256 is viable to length extension, brute-force and dictionary attacks. Randomness tests also showed uniform random distribution of the hashes generated by the modified SHA256

enter image description here

The meaning of each randomness test:

Monobit https://www.random.org/statistics/frequency-monobit/ Per block https://www.itl.nist.gov/div898/software/dataplot/refman1/auxillar/freqtest.html runs test https://www.investopedia.com/terms/r/runs_test.asp

enter image description here

Does anyone have a full copy of it?

& Do you have any comments about it's impact on the strength of all SHA-256 dependant systems? (cryptocurrencies for example)

Ps

I should've clarified that modified SHA-256 is supposed to have more cryptographic strength (as the 2nd table above shows). It was published in IEEE 2018

https://www.semanticscholar.org/paper/Modified-SHA256-for-Securing-Online-Transactions-on-Perez-Gerardo/d69b7c800dcf9373b6bf1a5111b1dc5d3bf077f4#extracted https://www.researchgate.net/publication/331747184_Modified_SHA256_for_Securing_Online_Transactions_based_on_Blockchain_Mechanism

This research is composed of online transaction security; the mechanism of blockchain and proposed a modified SHA256 security protocol through smart contract to secure online transaction procedure specifically based on Blockchain Mechanism. It focus on the discussion of modifying security protocol specifically designed for practical applications of blockchain with particular reference to privacy and trust. The researcher recommend a new transaction procedure involving customer and merchant, permitting entities to recognize one another enabling them to proceed with their transactions securely using Blockchain Mechanism

(it is a very well known fact that both IEEE & ACM are from the very top respectable conferences & journals)

Another HAI paper, Mar21, that gives an idea on how fast a brute force attack can be (although repeating that their results doesn't weaken SHA-256, however they also say that the rank of the Super Computer they used changed from 29th when they started to 463th now?!)

https://hal.archives-ouvertes.fr/hal-02306904v2

used https://github.com/bitmaintech/cgminer https://github.com/pooler/cpuminer

enter image description here

enter image description here

enter image description here

Improve this question
$\endgroup$
11
  • 2
    $\begingroup$ I think we'd need to know how they modified it to know whether the results are interesting. For example, if you reduce it to a small number of rounds, then it's trivially broken, but we already know that. Also, we already know that SHA-256 is vulnerable to length-extension attacks. That's not surprising. $\endgroup$
    – bk2204
    Jun 20, 2021 at 16:54
  • 4
    $\begingroup$ Reading the title of the paper, it's about a variant of SHA-256. Thus it does not "find cryptographic weakness of SHA-256". From the question, it's all too apparent that this paper falls to a serious mistake: using a statistical test to try to prove that an algorithm matches a cryptographic goal. Statistical tests can't do that; it's proven. I suggest to remove from your mind what of this paper's content you put in the question, but remember that some papers are best ignored, including some published by IEEE in ACM ICPS, which is very far from an assurance of quality. $\endgroup$
    – fgrieu ♦
    Jun 20, 2021 at 16:58
  • 2
    $\begingroup$ @fgrieu even read more than me, I've looked at the ref, and leave. Even the table is stupid. In what the hell, the small input space comparison makes their modification more secure or not. Usually, I refrain myself this kind of article!. If you really want to read it using a university to reach ACM or remove the boundaries... $\endgroup$
    – kelalaka
    Jun 20, 2021 at 17:14
  • 2
    $\begingroup$ Nope! I've seen many articles in the IEEE related conferences those has fundamental mistakes. IEEE is a community and had many conferences from high quality to lower. This ACM sub conference has a good name to tell it HPCCT & BDAI 2020: Proceedings of the 2020 4th High Performance Computing and Cluster Technologies Conference & 2020 3rd International Conference on Big Data and Artificial Intelligence $\endgroup$
    – kelalaka
    Jun 20, 2021 at 17:56
  • 3
    $\begingroup$ Even the abstract has all kind of mistakes, including trivial spelling mistakes. They don't even know how to spell SHA-256 (with the dash). This is about the document titled "Cryptanalysis of the Modified SHA256" of course. $\endgroup$
    – Maarten Bodewes ♦
    Jun 20, 2021 at 20:17

1 Answer 1

Reset to default
4
$\begingroup$

The question asks if this paper, and in particular it's table 3 (the second image in the question, more readable here) shows a cryptographic weakness of SHA-256.

No, it does not.

The table tells that the SHA-256 hash of password, 123456789, 111111, qwerty, and dragon are identified as such by Crackstation, Cmd5, and Hashcat; but the (different) hash of these strings by a different hash is not identified by these tools.

That does not prove anything negative about SHA-256 (and nothing in the title, abstract or figure of the article suggests the contrary). That at best illustrates the known fact it's not a good idea to hash a password with a standard fast hash and make the result public.

The article also tries to assess the cryptographic quality of a modification of SHA-256 by running standard statistical tests. At best, this could demonstrate a weakness, if the tests consistently failed. They do not. Thus nothing (beyond passing the test) is demonstrated.

The article is good at two things: it proves that being published in the ACM International Conference Proceeding Series is not a sure sign of being of interest. And that the same authors can get two papers on the same dull subject published in that series within a period of 3 months, see this earlier paper.

Improve this answer
$\endgroup$
5
  • $\begingroup$ You say that without reading the paper, I cannot accept it as an answer. I will go to Univ library & get a copy ASAP. $\endgroup$
    – ShAr
    Jun 22, 2021 at 14:58
  • 2
    $\begingroup$ @ShAr: I did read the abstract, and looked at the figures. Either is enough to make a (negative) informed opinion on the paper. If your interest is cryptography (rather than why dull papers get published under the ACM name), my recommendation is that you don't loose your time reading it. $\endgroup$
    – fgrieu ♦
    Jun 22, 2021 at 15:13
  • 2
    $\begingroup$ +1 for the extra paper. Notice the the reference list, too. $\endgroup$
    – kelalaka
    Jun 22, 2021 at 17:29
  • 1
    $\begingroup$ Randomness tests r of considerable importance (if not believe these references, it may guide u in a brute force attack to know the expected no of 1s in the resulting hash is 30% not 50% as uniform random) investopedia.com/terms/r/…. itl.nist.gov/div898/software/dataplot/refman1/auxillar/…. random.org/statistics/frequency-monobit $\endgroup$
    – ShAr
    Jun 22, 2021 at 20:01
  • 1
    $\begingroup$ @ShAr: Randomness tests are not useful to demonstrate that a cryptographic construct is good. The authors of the paper appear to think otherwise, which is a basic, serious, yet common mistake. I hope you do not. But we are drifting away from the question. $\endgroup$
    – fgrieu ♦
    Jun 22, 2021 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.