3 of 8
edited title

# In what aspects is the function based on four iterations of SHA-256 compression function weaker than the SHA-512 compression function?

Let $$F_{512}(B)$$ denote the underlying function (single block manipulation function) of SHA-256. This function takes a 512-bit input $$B$$ and produces 256 pseudo-random bits (eight 32-bit words). Then I can define the following function (that operates on a 1024-bit input $$B$$ and outputs 512 pseudo-random bits):

$$G_{1024}(B) = (x_1 \oplus x_3) \mathbin\Vert (x_2 \oplus x_4),$$

where $$\begin{array}{l} {x_1} = F_{512}({B_1}),\\ {x_2} = F_{512}({x_1} \oplus {B_2}),\\ {x_3} = F_{512}({x_2} \oplus {B_1}),\\ {x_4} = F_{512}({x_3} \oplus {B_2}) \end{array}$$

and $$B_i$$ denotes the first/second half of the 1024-bit input.

Let $$F_{1024}(B)$$ denote the underlying function (single block manipulation function) of SHA-512. This function takes a 1024-bit input $$B$$ and produces 512 pseudo-random bits (eight 64-bit words).

Yes, $$G_{1024}$$ may be slower than $$F_{1024}$$, but is $$G_{1024}$$ weaker than $$F_{1024}$$ from the cryptographic point of view? If yes, in what aspects?