Hot answers tagged

36 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
fgrieu's user avatar
  • 140k
31 votes
Accepted

Why hashing twice?

A common rationale for hashing twice is to guard against the length-extension property of the hash (if it has that property, as many hashes before SHA-3 did). For SHA-256, this property allows to ...
fgrieu's user avatar
  • 140k
31 votes
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
fgrieu's user avatar
  • 140k
27 votes
Accepted

What's the difference between PBKDF and SHA and why use them together?

SHA-512 is a cryptographically secure hash, PBKDF2 is what we call a Password Based Key Derivation Function. If the resulting secret isn't used as key but as hash value it's also called a password ...
Maarten Bodewes's user avatar
  • 92.3k
22 votes

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
Richie Frame's user avatar
  • 13.1k
21 votes
Accepted

Are there any well-known examples of SHA-256 collisions?

No, there is not any known SHA-256 collision. Publication of one, or of a remotely feasible method to obtain one, would be considered major. It is next to impossible that two distinct strings with ...
fgrieu's user avatar
  • 140k
20 votes
Accepted

Why does SHA2-224 use different IV's than SHA2-256?

The $\operatorname{SHA-224}$ is defined in the exact same manner as $\operatorname{SHA-256}$ with different initial values and the digest is obtained truncating the hash value, FIPS PUB 180-4 Page 23. ...
kelalaka's user avatar
  • 48.3k
19 votes

What's the difference between PBKDF and SHA and why use them together?

To paraphrase my answer to an earlier question, PBKDF2 is a generic high-level algorithm that internally calls a pseudorandom function (PRF) to process its input. The PBKDF2 spec does not mandate any ...
Ilmari Karonen's user avatar
17 votes

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

With a 1024 qubit quantum computer you cannot break any of the algorithm you mentioned. Current estimations for an impelmentation of Grover's algorithm for AES requires much more qubits. According to ...
Ruggero's user avatar
  • 7,014
15 votes
Accepted

Is SHA 2 suitable for key derivation?

In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret. But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
CodesInChaos's user avatar
  • 24.8k
15 votes

Is SHA 2 suitable for key derivation?

Yes. Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either: breaking your DH protocol, this follows from the fact that ...
Lery's user avatar
  • 7,649
14 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
Thomas Pornin's user avatar
11 votes

Which bitwise operations are used in SHA-256?

The functions used by SHA-2, called $Ch$ and $Maj$ are defined like this in the standard: $$Ch(x, y, z) = (x \land y) \oplus (\lnot x \land z)$$ $$Maj(x, y, z) = (x \land y) \oplus (x \land z) \...
otus's user avatar
  • 32.1k
11 votes
Accepted

Extending the size of input for SHA-2 function

$2^{64-1}$ bits that make 2.30584301 exabytes *. If you are not restricted to SHA256, then use SHA512 that allows files to have size at most $2^{128}-1$, or use SHA3 that has no limit. The NIST must ...
kelalaka's user avatar
  • 48.3k
11 votes

Outlook of trustworthiness of SHA-2

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
kelalaka's user avatar
  • 48.3k
10 votes

Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
R.. GitHub STOP HELPING ICE's user avatar
9 votes
Accepted

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different ...
fgrieu's user avatar
  • 140k
9 votes

Is it possible to fake any file's SHA-256 checksum with a length extension attack?

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO ...
poncho's user avatar
  • 146k
9 votes
Accepted

Are SHA-256 and SHA-512 collision resistant?

Cryptographic hash functions by design cannot be collision-free since they operate on arbitrary-sized input to fixed-sized outputs sizes $$H:\{0,1\}^* \to \{0,1\}^b$$ where $b$ is the $H$'s output ...
kelalaka's user avatar
  • 48.3k
8 votes
Accepted

How can I verifiably announce a choice without revealing its content?

This is the premise of a commitment scheme. The dramatis personae in this setting are the prover, Peggy, who wishes to prove foreknowledge of a message $m$ to a verifier, Victor, but only later ...
Squeamish Ossifrage's user avatar
8 votes
Accepted

Transforming SHA-512 into SHA-512/256?

Like Richie Frame commented, as SHA-2 padding uses the length of the message that is not possible. Specifically, even if you had some string of input that took you from the SHA-512 IV to the SHA-512/...
otus's user avatar
  • 32.1k
8 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

While Switch is right about the difference between Merkle–Damgård and Sponge constructions, I don't believe he is correct as to NIST's reasoning. I happened to talk to a NIST cryptographer (John ...
poncho's user avatar
  • 146k
8 votes

What is the sponge construction in simple terms?

I find that the following image from Wikipedia, though perhaps a bit too technical for your purposes, is still helpful with a little explanation: Essentially, a function $f$ is used repeatedly in two ...
thesquaregroot's user avatar
8 votes

Why SHA-512/256 when we already have SHA-384?

The truncated versions of SHA2 are introduced in 2005 and in the Cryptographic hash Workshop, in 2005, Kelsey listed the reasons as; Interoperability and security reasons Need drop-in replacement for ...
kelalaka's user avatar
  • 48.3k
7 votes
Accepted

Origin of the SHA-224 initial hash value?

The SHA-224 initial values are the second 32 bits of the fractional parts of the square roots of the 9th through 16th primes (namely, 23 through 53), or in other words, $\lfloor 2^{64} \sqrt{p} \...
poncho's user avatar
  • 146k
7 votes

SHA-1 – Would using a SHA1 signature be a risk?

Yes, it is. A chain is as strong as its weakest link. Strengthening one link, e.g. using a SHA-2 certificate instead of a SHA-1 certificate, will not strengthen any other link. You cannot prevent ...
Henrick Hellström's user avatar
7 votes

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

Using different initial values means that finding collisions must be done independently for both algorithms. This is admittedly not an authoritative source, but I found the description in this answer ...
thesquaregroot's user avatar
6 votes

What is the length field in SHA-512 padding?

In $\text{SHA-512}$ the size of the blocks is 1024 bit. The last block must contain: the rest of data in message (mod 1024). some filling (padding) the last 128 bits as ...
Ibrahim Albarki's user avatar
6 votes
Accepted

Can the SHA256 hashes of consecutive integers be attacked?

If we assume that the range of possible values of $n/k$ is sufficiently large that it is infeasible for the attacker to scan through $\operatorname{SHA256}(ik)$ values (and look for a match in one of ...
poncho's user avatar
  • 146k

Only top scored, non community-wiki answers of a minimum length are eligible