5 ms·

Depends on your definition of 'better'. Theoretically SHA-512 is harder to brute force than SHA-256, but 256 bits is already extremely strong, so really there i

by LeonM 7y ago

Depends on your definition of 'better'. Theoretically SHA-512 is harder to brute force than SHA-256, but 256 bits is already extremely strong, so really there is no practical safety benefit of SHA-512 over SHA-256. On 64-bit capable processors SHA-512 has a slight performance gain over SHA-256, but only on larger inputs. However, the digest of SHA-512 is twice the size, so what you gain in processing time, you loose in storage.

quotemstr 7y ago
You can truncate the SHA-512 digest down to 256 bits though. Cryptographic hash functions mix well and don't suffer from the truncation (except to the extent that the truncated digest is shorter, of course). You don't necessarily need more storage (after hashing completes) just because you're using a new hash function.
jlokier 7y ago
> but 256 bits is already extremely strong The strength of hashes like SHA-256 doesn't just come from the number of output bits. The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values. SHA-512 performs more "rounds" of computation than SHA-256. Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision. If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered. The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.
- tptacek 7y ago
  Cryptographic engineers do not in fact think you should use SHA-2-512 so that you can maximize the number of times the round function is applied.
  - jlokier 7y ago
    I'm not sure what that sentence means, can you rephrase it?
    - tptacek 7y ago
      The analysis you have provided for why SHA-512 is superior to SHA-256 is faulty.
      - jlokier 7y ago
        The analysis was only supposed to explain why the 256-bit length of the hash output is not the sole determinant of a hash's strength. The parent was saying that, that's why it's quoted in my reply. Pity it didn't come across that way.

by LeonM 7y ago

quotemstr 7y ago

You can truncate the SHA-512 digest down to 256 bits though. Cryptographic hash functions mix well and don't suffer from the truncation (except to the extent that the truncated digest is shorter, of course). You don't necessarily need more storage (after hashing completes) just because you're using a new hash function.

jlokier 7y ago

> but 256 bits is already extremely strong The strength of hashes like SHA-256 doesn't just come from the number of output bits. The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values. SHA-512 performs more "rounds" of computation than SHA-256. Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision. If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered. The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.

tptacek 7y ago
Cryptographic engineers do not in fact think you should use SHA-2-512 so that you can maximize the number of times the round function is applied.
- jlokier 7y ago
  I'm not sure what that sentence means, can you rephrase it?
  - tptacek 7y ago
    The analysis you have provided for why SHA-512 is superior to SHA-256 is faulty.
    - jlokier 7y ago
      The analysis was only supposed to explain why the 256-bit length of the hash output is not the sole determinant of a hash's strength. The parent was saying that, that's why it's quoted in my reply. Pity it didn't come across that way.