Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sha-2]

SHA-2 is a family of cryptographic hash functions designed by the NSA and published by NIST in 2001. The family includes various output lengths (224, 256, 384, and 512 bits).

3
votes
1answer
75 views

Can length extension attacks be avoided by a single bit flip?

It always seemed to me that length extensions are possible simply because no special operation is performed after the last operation - for instance in a Merkle-Damgård construction. Basically the MD ...
2
votes
2answers
212 views

Mutating a SHA-2 input would allow us to have multiple hashes for a single input, would this increase SHA-2's security?

Let me elaborate: Say we have two distinct inputs: $A$ and $B$. We also have some arbitrary deterministic mutation protocol $M$ (for example reversing the characters and performing a Caesar cipher). ...
2
votes
1answer
89 views

Why is SHA2 used for file verification if it's susceptible to length extension attacks?

Am I misunderstanding length extension attacks, or is there some different reason, or is it really a bad idea to use SHA2 for file verification? If the answer is that it's really a bad idea, would ...
8
votes
2answers
392 views

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

NIST specified SHA-2 hash functions with truncated output. Those hashes use different initialization values than SHA-256 or SHA-512. SHA-224 is based on SHA-256. SHA-384, SHA-512/224 and SHA-512/256 ...
1
vote
1answer
473 views

HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC. I found this table in RFC5246: ...
3
votes
1answer
539 views

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
0
votes
2answers
138 views

Can I update sha-256 digest chunk-wise instead of the whole array at once?

I'm not sure whether this questions is about SHA-256 algorithm itself or the particular implementation I'm using. Usually, a hash algorithm implementation has functions, let us call them update and ...
2
votes
1answer
73 views

Why is modulo being used for congruence in SHA-2 padding when the outcome is always the same?

I am reading up on SHA-2 algorithms and I came across this paper: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf In section 5.2.1 it talks about the formula for padding a message. There ...
2
votes
1answer
108 views

Why does FIPS-180-4 require the final padding block start with a 1?

From FIPS-180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
1
vote
1answer
90 views

Why hash ( clear text + Secret ) instead of hash (encrpt(clear text) [ + secret ] )

Here is an excellent article on how SSH Authentication and Encryption works. While thinking about how MAC's work, I had the same doubt as one of the comments left on the post: The client combines ...
1
vote
1answer
533 views

Use sha3 for passwords hashing

Is use of sha3 justifiable? Is sha3 better than sha2 in (m)any aspects? P.S. I want to use hashing for passwords in a database
2
votes
1answer
89 views

Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?

SHA-2 has two functions: $\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$ $\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$ Are these two functions non-linear? ...
1
vote
1answer
95 views

Cut through mode for TLS AES-CBC / SHA ciphersuite

I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode. Let's suppose that received record spans two segments. As i understood HMAC ...
7
votes
1answer
2k views

Are there any well-known examples of SHA-256 collisions?

The popularity of SHA-256 as a hashing algorithm, along with the fact that it has 2256 buckets to choose from leads me to believe that collisions do exist but are quite rare. Are there any well-...
1
vote
1answer
119 views

Using non-standard constants for SHA-256

For SHA-256, FIPS 180-4 states the following on the constants: These words represent the first thirty-two bits of the fractional parts of the cube roots of the first sixty-four prime numbers. If ...
0
votes
1answer
125 views

Security trade-off when using low number of rounds with SHA256

I have a web application that stores hashed password reset tokens in a database table. The tokens are randomly generated 256-bit values. I'm currently using Python's passlib sha256_crypt function to ...
1
vote
1answer
79 views

Can I use `SHA (message || key)` as MAC? [duplicate]

One should not use SHA for MAC, because knowing SHA(key || message) and message you can construct ...
-4
votes
1answer
476 views

Would Hashing A Password In Sha512 Using JavaScript Be Secure?

I've created a competition for a few friends of mine that wanted to learn the basics of penetration testing. In said competition, there is one section in which there's a log file you need to check out ...
4
votes
2answers
1k views

Is SHA 2 suitable for key derivation?

Let's imagine that I've got a number modulo n given by DH protocol. I want to use it as a key for AES encryption. So I have to cut this number to fit it in AES (...
1
vote
0answers
76 views

Long Term Security of Truecrypt's hash function?

Does Truecrypt's hash function weaken the security of a chosen cipher cascade? Considering I want to choose a cipher cascade of 3 ciphers for long term security (50+ years) for my archived data on ...
1
vote
0answers
114 views

does SHA* collide more or less than a random function?

There were several questions here regarding how surjective SHA-1/2 is, how many values don't have a pre-image from a fixed size input. I and others answered when modelling the relevant hash function ...
23
votes
1answer
5k views

Why hashing twice?

I'm trying to understand the Bitcoin protocol, and sometimes see instructions like this: The TransactionId is defined by SHA256(SHA256(txbytes)) or The hash of the public key is generated by ...
4
votes
1answer
2k views

NIST Test Vectors for SHA2 and SHA3

I want to run the SHA2 and SHA3 NIST algorithm test vectors provided in the zip files at the bottom of this page: http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html#sha-2 I don't quite ...
0
votes
2answers
541 views

How different is SHA512/224 when compared with SHA512?

From http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf Nist document what i understood is while implementing SHA512 and SHA512/224 the two differences are the Initial hash value and the final ...
7
votes
1answer
432 views

Why does SHA-2 call for doing 10* padding in addition to appending the message length?

Appending the length of the message when padding of a SHA-2 message is sufficient to satisfy the Merkle-Damgård construction. However the padding in SHA-2 also pads with 10* between the end of the ...
1
vote
1answer
538 views

Questions about SHA and SHAKE [duplicate]

So I got bored one weekend so I thought I would make a login system in python. I then realized if I wanted to reuse the accounts I made I had to store the account details locally. I realized I had to ...
5
votes
1answer
1k views

SHA-1 – Would using a SHA1 signature be a risk?

If data (e.g. an e-mail, pdf file, xml content) is hashed using SHA-1 and then signed by a SHA-2 certificate, is this any bigger of a risk than using a SHA-2 hash with a SHA-2 certificate? I assume ...
0
votes
2answers
287 views

Creating UID's using hash functions - most appropriate hashing algorithm?

I have circa 1 million datapoints, each with a unique integer ranging from 6 to 24 digits: ...
3
votes
1answer
381 views

Origin of the SHA-224 initial hash value?

At the start of each of the SHA-0 through -2 algorithms, the initial state is set to certain constants. I'm curious where the initialization values in SHA-224 are from. MD5's initial values are ...
0
votes
1answer
834 views

How are messages larger than 512 bits padded in SHA-256? [duplicate]

In the NIST documentation for the Secure Hash Standard, it says to pad every message by appending the bit "1" to the end of the message, followed by k zero bits, where k is equal to the equation l (...
2
votes
0answers
142 views

Why do the boolean functions used in cryptographic hashfunctions have 3 inputs (and not more)?

I'm learning about cryptographic hash functions and know why certain boolean functions were chosen to be used in the compression function of cryptographic hash functions (older question). Hash ...
3
votes
1answer
527 views

Why are cube and square roots of primes used as SHA constants?

Do square or cube roots have properties that make them a better choice over, for example, the primes themselves? Or is it arbitrary - would random numbers work as effectively?
28
votes
1answer
2k views

How are the functions used in cryptographic hash functions chosen?

I'm learning about cryptographic hash functions and I have some questions about the functions used in the compression function. MD5 uses the following functions: $f_{1}(B,C,D)=(B\wedge C)\lor(D\...
0
votes
0answers
54 views

Verifiably announce a choice without revealing its content

Here is the simplified problem: Alice chooses from a small set of possible values. Bob guesses which value Alice picked. Alice reveals what value she picked. Alice's choice must stay secret ...
3
votes
1answer
332 views

Advantages of using 64-bit word size over 32-bit word size

I'm learning about cryptographic hash functions and I have some questions about SHA-2. SHA-256 uses 8 32-bit words. SHA-512 uses 8 64-bit words. Is there a specific reason why SHA-512 uses 64-bit ...
1
vote
0answers
79 views

SHA-2 attempts for a loop [duplicate]

Say I am hashing hashes (taking the hash of a previous hash) for an endless amount of time. How many times would it take, on average, to fall into a loop when using SHA-2 (more specifically SHA-256 ...
3
votes
1answer
475 views

Change initial hash value of SHA512/t

Fips 180-4 defines under 5.3.6 how to calculate initial hash values for SHA512/t for a given value t. Can someone explain me how the t actually affects the outcome of the procedure (which, as far as I ...
7
votes
2answers
3k views

What's the difference between PBKDF and SHA and why use them together?

I've been reading a little bit about hashing lately and according to AgileBits, they use "SHA512 within PBKDF2" in their new vault file. I've looked in Wikipedia for both names and I know PBKDF2 is a ...
4
votes
1answer
322 views

How are the IVs of SHA512/256 and SHA512/224 calculated?

This seems odd to me, because there are a lot of resources out there saying that the initializer values of SHA512 and SHA384 are the first 64 bits of the fractional parts of the square roots of prime ...
3
votes
2answers
419 views

Is Schannel supposed to use SHA1 for (EC)DHE params?

I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures. ...
3
votes
1answer
104 views

Randomness and reversibility of a sequence generated by taking sha256 hashes of an predictably-changing input?

Let's say we generate a sentence in a way like for example this: Fix an initial seed. Attach '1' at the end of the seed and compute sha256 of such a string. This hash is our first number. Now attach 2 ...
4
votes
3answers
501 views

Can the SHA256 hashes of consecutive integers be attacked?

Suppose that the attacker knows the SHA256 values of integers $n, n+1, n+2 ... n+k$. $n$ is sufficiently big, so we do not expect to be able to brute force $n$ just by $\operatorname{SHA256}(n)$ ...
2
votes
1answer
127 views

“Security” of SHA functions (Wikipedia), what does it mean?

Wikepedia's table Comparison of SHA functions mentions "Security(bits)" for some SHA functions. From the ratio (Output size (bits): Security(bits)), I feel it is something like "collision resistance". ...
6
votes
1answer
80 views

Difficulty to find any preimages $a$ and $b$ for given $V$ so that $H(a) \oplus H(b) = V$?

Suppose I have the values $a$, $b$, and $V = H(a) \oplus H(b)$ with inputs $a \neq b$ and $H$ being SHA-224. None of these values are a secret. How secure is it to assume that no other possible values ...
9
votes
3answers
7k views

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5. Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered ...
5
votes
2answers
1k views

Which bitwise operations are used in SHA-256?

From the wikipedia entry on SHA-256 I'm a bit confused about which operations actually go into the algorithm. From the pseudo code it appears the operations are $\texttt{xor}$, $\texttt{and}$, rotate, ...
7
votes
1answer
1k views

Transforming SHA-512 into SHA-512/256?

Based on my skimming over FIPS 180-4 it looks like the only difference between SHA-512 and SHA-512/256 is the initial hash value and the fact that the final output is truncated to 256 bits. My ...
2
votes
1answer
152 views

Would SHA-1 be safe for certificates with short validity?

There are articles floating around the topic of SHA-1 deprecation. The gist of it is that in (mostly) developing countries, people are still using mobile/computing devices that are 5 years old (or ...
0
votes
1answer
248 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
4
votes
2answers
5k views

Algorithm for generating OAuth tokens

I'm trying to find a good algorithm for generating authorization codes, access tokens and refresh tokens in an API. Currently, I am looking into the following setup: Tokens are generated using the <...