The answer depends on assumptions on plaintext
.
If an adversary can enumerate the possible plaintext
(e.g. if plaintext
is a password, mediocre passphrase, or a published file) then yes: knowledge of h1
or h2
allows finding what plaintext
is, by verifying beyond reasonable doubt an hypothesis made.
If plaintext
can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H
that SHA-256
may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used
h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )