Skip to main content
36 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
fgrieu's user avatar
  • 142k
31 votes
Accepted

Why hashing twice?

A common rationale for hashing twice is to guard against the length-extension property of the hash (if it has that property, as many hashes before SHA-3 did). For SHA-256, this property allows to ...
fgrieu's user avatar
  • 142k
31 votes
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
fgrieu's user avatar
  • 142k
27 votes
Accepted

What's the difference between PBKDF and SHA and why use them together?

SHA-512 is a cryptographically secure hash, PBKDF2 is what we call a Password Based Key Derivation Function. If the resulting secret isn't used as key but as hash value it's also called a password ...
Maarten Bodewes's user avatar
  • 93.2k
22 votes

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
Richie Frame's user avatar
  • 13.1k
21 votes
Accepted

Are there any well-known examples of SHA-256 collisions?

No, there is not any known SHA-256 collision. Publication of one, or of a remotely feasible method to obtain one, would be considered major. It is next to impossible that two distinct strings with ...
fgrieu's user avatar
  • 142k
20 votes
Accepted

Why does SHA2-224 use different IV's than SHA2-256?

The $\operatorname{SHA-224}$ is defined in the exact same manner as $\operatorname{SHA-256}$ with different initial values and the digest is obtained truncating the hash value, FIPS PUB 180-4 Page 23. ...
kelalaka's user avatar
  • 49k
19 votes

What's the difference between PBKDF and SHA and why use them together?

To paraphrase my answer to an earlier question, PBKDF2 is a generic high-level algorithm that internally calls a pseudorandom function (PRF) to process its input. The PBKDF2 spec does not mandate any ...
Ilmari Karonen's user avatar
17 votes

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

With a 1024 qubit quantum computer you cannot break any of the algorithm you mentioned. Current estimations for an impelmentation of Grover's algorithm for AES requires much more qubits. According to ...
Ruggero's user avatar
  • 7,104
15 votes
Accepted

Is SHA 2 suitable for key derivation?

In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret. But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
CodesInChaos's user avatar
  • 24.9k
15 votes

Is SHA 2 suitable for key derivation?

Yes. Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either: breaking your DH protocol, this follows from the fact that ...
Lery's user avatar
  • 7,719
14 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
Thomas Pornin's user avatar
11 votes
Accepted

Extending the size of input for SHA-2 function

$2^{64-1}$ bits that make 2.30584301 exabytes *. If you are not restricted to SHA256, then use SHA512 that allows files to have size at most $2^{128}-1$, or use SHA3 that has no limit. The NIST must ...
kelalaka's user avatar
  • 49k
11 votes

Outlook of trustworthiness of SHA-2

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
kelalaka's user avatar
  • 49k
10 votes

Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
R.. GitHub STOP HELPING ICE's user avatar
9 votes
Accepted

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different ...
fgrieu's user avatar
  • 142k
9 votes

What is the sponge construction in simple terms?

I find that the following image from Wikipedia, though perhaps a bit too technical for your purposes, is still helpful with a little explanation: Essentially, a function $f$ is used repeatedly in two ...
thesquaregroot's user avatar
9 votes

Is it possible to fake any file's SHA-256 checksum with a length extension attack?

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO ...
poncho's user avatar
  • 148k
9 votes
Accepted

Are SHA-256 and SHA-512 collision resistant?

Cryptographic hash functions by design cannot be collision-free since they operate on arbitrary-sized input to fixed-sized outputs sizes $$H:\{0,1\}^* \to \{0,1\}^b$$ where $b$ is the $H$'s output ...
kelalaka's user avatar
  • 49k
8 votes
Accepted

How can I verifiably announce a choice without revealing its content?

This is the premise of a commitment scheme. The dramatis personae in this setting are the prover, Peggy, who wishes to prove foreknowledge of a message $m$ to a verifier, Victor, but only later ...
Squeamish Ossifrage's user avatar
8 votes

Why SHA-512/256 when we already have SHA-384?

The truncated versions of SHA2 are introduced in 2005 and in the Cryptographic hash Workshop, in 2005, Kelsey listed the reasons as; Interoperability and security reasons Need drop-in replacement for ...
kelalaka's user avatar
  • 49k
7 votes
Accepted

Origin of the SHA-224 initial hash value?

The SHA-224 initial values are the second 32 bits of the fractional parts of the square roots of the 9th through 16th primes (namely, 23 through 53), or in other words, $\lfloor 2^{64} \sqrt{p} \...
poncho's user avatar
  • 148k
7 votes

SHA-1 – Would using a SHA1 signature be a risk?

Yes, it is. A chain is as strong as its weakest link. Strengthening one link, e.g. using a SHA-2 certificate instead of a SHA-1 certificate, will not strengthen any other link. You cannot prevent ...
Henrick Hellström's user avatar
7 votes

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

Using different initial values means that finding collisions must be done independently for both algorithms. This is admittedly not an authoritative source, but I found the description in this answer ...
thesquaregroot's user avatar
6 votes

Why does SHA-2 call for doing 10* padding in addition to appending the message length?

As rightly pointed in the question, 0*+length padding would work just as well as 10*+length padding, with the benefit of simplicity and requiring one less block in some cases, like SHA-256 for a ...
fgrieu's user avatar
  • 142k
6 votes
Accepted

Use sha3 for passwords hashing

Is sha3 better than sha2 in (m)any aspects? SHA3 is built on-top of a fundamentally different construction than SHA-2 which has many nice properties. So yes, in many hash-function relevant aspects it ...
SEJPM's user avatar
  • 46.1k
6 votes
Accepted

HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below Good question. It turns out that TLS always uses the same length of key as the hash ...
poncho's user avatar
  • 148k
6 votes
Accepted

The length extension attack and security on length shortening of a hashed message by one byte

Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know the last byte? No, the length extension attacks are not working exactly like that. Let see ...
kelalaka's user avatar
  • 49k
6 votes

Extending the size of input for SHA-2 function

The size is just restricted by a length encoding at the end of the last block that is hashed using SHA-256 - one of the two main hash functions that make up the SHA-2 family. If you extend that size ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes
Accepted

NIST example shows extra hexadecimal characters in Block Contents of SHA512-256

It is the byte padding of SHA-512 encoded as the big-endian, simply add bit 1, that is the last 0x80 in the begging part fill ...
kelalaka's user avatar
  • 49k

Only top scored, non community-wiki answers of a minimum length are eligible