7 ms·

Quick question about the "What should I do" section. It says "use instead SHA-256". Isn't SHA-512 both better and faster on modern hardware?

by ebg13 7y ago

Spooky23 7y ago
SHA-256 is on the approved FIPS lists and are faster on 32-bit operating systems, which were surprisingly common in enterprise environments until recently. People tend to be conservative in making changes for stuff like this, and don't do so until forced.
akvadrako 7y ago
I believe so also. Specifically, SHA-512/256 seems to be a better choice by almost every metric except 32-bit hashing speed.
LeonM 7y ago
Depends on your definition of 'better'. Theoretically SHA-512 is harder to brute force than SHA-256, but 256 bits is already extremely strong, so really there is no practical safety benefit of SHA-512 over SHA-256. On 64-bit capable processors SHA-512 has a slight performance gain over SHA-256, but only on larger inputs. However, the digest of SHA-512 is twice the size, so what you gain in processing time, you loose in storage.
- quotemstr 7y ago
  You can truncate the SHA-512 digest down to 256 bits though. Cryptographic hash functions mix well and don't suffer from the truncation (except to the extent that the truncated digest is shorter, of course). You don't necessarily need more storage (after hashing completes) just because you're using a new hash function.
- jlokier 7y ago
  > but 256 bits is already extremely strong The strength of hashes like SHA-256 doesn't just come from the number of output bits. The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values. SHA-512 performs more "rounds" of computation than SHA-256. Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision. If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered. The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.
  - tptacek 7y ago
    Cryptographic engineers do not in fact think you should use SHA-2-512 so that you can maximize the number of times the round function is applied.
    - jlokier 7y ago
      I'm not sure what that sentence means, can you rephrase it?
      - tptacek 7y ago
        The analysis you have provided for why SHA-512 is superior to SHA-256 is faulty.
        jlokier 7y ago
        The analysis was only supposed to explain why the 256-bit length of the hash output is not the sole determinant of a hash's strength. The parent was saying that, that's why it's quoted in my reply. Pity it didn't come across that way.
CiPHPerCoder 7y ago
SHA-256 and SHA-512 are both in the same family (SHA-2). Latacora says to use SHA-2. If you can get away with it, SHA-512/256 instead of SHA-256. But they're all SHA-2 family hash functions. https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html#hashing-algorithm https://latacora.micro.blog/2018/04/03/cryptographic-right-a... No need to bikeshed this. But if you must: SHA-512/256 > SHA-384 > SHA-512 = SHA-256 If you're wondering, "Why is SHA-384 better than SHA-512 and SHA-256?" the answer is the same reason why SHA-512/256 is the most preferred option: https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks https://blog.skullsecurity.org/2012/everything-you-need-to-k... Additionally, the Intel SHA extensions target SHA1 and SHA-256 (but not SHA-512), which makes SHA-256 faster than SHA-512 on newer processors. Isn't crypto fun?
- fireflash38 7y ago
  I read the blog, but it doesn't really expand on why SHA224/384 aren't vulnerable to that attack, can you explain (or link to some place that does?)
  - CiPHPerCoder 7y ago
    Because they're already truncated. SHA-384 is SHA-512 with a different IV (which doesn't affect LEAs) truncated to 384 bits (which gives you 128 bits of resistance against LEAs). SHA-224 is the same story but with SHA-256 instead (and only 32 bits of LEA resistance).
  - tptacek 7y ago
    A length-extension attack works by taking the output of a hash and using it as the starting point for a new hash; you can do this even for hashes of messages you haven't seen, minting new related hashes. Truncated SHA-2 hashes don't output the whole hash, and so you aren't given enough information to start a new related hash.
- colanderman 7y ago
  I'm super confused. Are SHA-256 and SHA256 different, and if so, why in the world would this be considered a sane naming scheme? If not, I completely do not understand the inequation you wrote, which seemingly lists SHA-256 (and -512) multiple times.
GlitchMr 7y ago
SHA-256 is shorter, and there isn't much of a difference between SHA-256 and SHA-512 (they are both using SHA-2 algorithm).
deleted 7y ago
[deleted]
woadwarrior01 7y ago
FWIW, the instructions in Intel SHA extensions (which are also supported on modern AMD processors starting from Ryzen onwards) only support SHA-1 and SHA-256.
deleted 7y ago
[deleted]
oconnor663 7y ago
SHA-512 provides a higher security level (256 bits), but there's not much practical value in a security level higher than 128 bits. I think "better" is too strong a word here. SHA-512 is faster than SHA-256 in software on 64-bit machines. That's a more important difference than the security level. However, there are two major caveats to consider: 1) Hash function performance is more likely to matter on cheap (non-64-bit) hardware where everything is slow, than on fancy hardware where everything is fast. 2) Some x86 and ARM chips have hardware accelerated implementations of SHA-256, but not of SHA-512.

Quick question about the "What should I do" section. It says "use instead SHA-256". Isn't SHA-512 both better and faster on modern hardware?

by ebg13 7y ago

Quick question about the "What should I do" section. It says "use instead SHA-256". Isn't SHA-512 both better and faster on modern hardware?

Spooky23 7y ago

SHA-256 is on the approved FIPS lists and are faster on 32-bit operating systems, which were surprisingly common in enterprise environments until recently. People tend to be conservative in making changes for stuff like this, and don't do so until forced.

akvadrako 7y ago

I believe so also. Specifically, SHA-512/256 seems to be a better choice by almost every metric except 32-bit hashing speed.

LeonM 7y ago

Depends on your definition of 'better'. Theoretically SHA-512 is harder to brute force than SHA-256, but 256 bits is already extremely strong, so really there is no practical safety benefit of SHA-512 over SHA-256. On 64-bit capable processors SHA-512 has a slight performance gain over SHA-256, but only on larger inputs. However, the digest of SHA-512 is twice the size, so what you gain in processing time, you loose in storage.

quotemstr 7y ago
You can truncate the SHA-512 digest down to 256 bits though. Cryptographic hash functions mix well and don't suffer from the truncation (except to the extent that the truncated digest is shorter, of course). You don't necessarily need more storage (after hashing completes) just because you're using a new hash function.
jlokier 7y ago
> but 256 bits is already extremely strong The strength of hashes like SHA-256 doesn't just come from the number of output bits. The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values. SHA-512 performs more "rounds" of computation than SHA-256. Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision. If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered. The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.
- tptacek 7y ago
  Cryptographic engineers do not in fact think you should use SHA-2-512 so that you can maximize the number of times the round function is applied.
  - jlokier 7y ago
    I'm not sure what that sentence means, can you rephrase it?
    - tptacek 7y ago
      The analysis you have provided for why SHA-512 is superior to SHA-256 is faulty.
      - jlokier 7y ago
        The analysis was only supposed to explain why the 256-bit length of the hash output is not the sole determinant of a hash's strength. The parent was saying that, that's why it's quoted in my reply. Pity it didn't come across that way.

CiPHPerCoder 7y ago

SHA-256 and SHA-512 are both in the same family (SHA-2). Latacora says to use SHA-2. If you can get away with it, SHA-512/256 instead of SHA-256. But they're all SHA-2 family hash functions. https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html#hashing-algorithm https://latacora.micro.blog/2018/04/03/cryptographic-right-a... No need to bikeshed this. But if you must: SHA-512/256 > SHA-384 > SHA-512 = SHA-256 If you're wondering, "Why is SHA-384 better than SHA-512 and SHA-256?" the answer is the same reason why SHA-512/256 is the most preferred option: https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks https://blog.skullsecurity.org/2012/everything-you-need-to-k... Additionally, the Intel SHA extensions target SHA1 and SHA-256 (but not SHA-512), which makes SHA-256 faster than SHA-512 on newer processors. Isn't crypto fun?

fireflash38 7y ago
I read the blog, but it doesn't really expand on why SHA224/384 aren't vulnerable to that attack, can you explain (or link to some place that does?)
- CiPHPerCoder 7y ago
  Because they're already truncated. SHA-384 is SHA-512 with a different IV (which doesn't affect LEAs) truncated to 384 bits (which gives you 128 bits of resistance against LEAs). SHA-224 is the same story but with SHA-256 instead (and only 32 bits of LEA resistance).
- tptacek 7y ago
  A length-extension attack works by taking the output of a hash and using it as the starting point for a new hash; you can do this even for hashes of messages you haven't seen, minting new related hashes. Truncated SHA-2 hashes don't output the whole hash, and so you aren't given enough information to start a new related hash.
colanderman 7y ago
I'm super confused. Are SHA-256 and SHA256 different, and if so, why in the world would this be considered a sane naming scheme? If not, I completely do not understand the inequation you wrote, which seemingly lists SHA-256 (and -512) multiple times.

GlitchMr 7y ago

SHA-256 is shorter, and there isn't much of a difference between SHA-256 and SHA-512 (they are both using SHA-2 algorithm).

deleted 7y ago

[deleted]

woadwarrior01 7y ago

FWIW, the instructions in Intel SHA extensions (which are also supported on modern AMD processors starting from Ryzen onwards) only support SHA-1 and SHA-256.

deleted 7y ago

[deleted]

oconnor663 7y ago

SHA-512 provides a higher security level (256 bits), but there's not much practical value in a security level higher than 128 bits. I think "better" is too strong a word here. SHA-512 is faster than SHA-256 in software on 64-bit machines. That's a more important difference than the security level. However, there are two major caveats to consider: 1) Hash function performance is more likely to matter on cheap (non-64-bit) hardware where everything is slow, than on fancy hardware where everything is fast. 2) Some x86 and ARM chips have hardware accelerated implementations of SHA-256, but not of SHA-512.