Skip to main content
3 of 4
Close that parenthesis
fgrieu
  • 145.7k
  • 12
  • 319
  • 611

The answer depends on assumptions on plaintext.

If an adversary can enumerate the possible plaintext (e.g. if plaintext is a password, mediocre passphrase, or a published file) then yes: knowledge of h1 or h2 allows finding what plaintext is, by verifying beyond reasonable doubt an hypothesis made.

If plaintext can't be guessed (e.g has 128 bits of entropy), then we are safe for some strong enough hypothesis on H that SHA-256 may meet.. or perhaps not. As pointed in another answer, we'd have the HMAC security argument if we used

h1 = HMAC( Hash=SHA-256, Key=root, Message=salt1 )
h2 = HMAC( Hash=SHA-256, Key=root, Message=salt2 )
fgrieu
  • 145.7k
  • 12
  • 319
  • 611