4 ms·
I'm super confused. Are SHA-256 and SHA256 different, and if so, why in the world would this be considered a sane naming scheme? If not, I completely do not un
by colanderman 7y ago
I'm super confused. Are SHA-256 and SHA256 different, and if so, why in the world would this be considered a sane naming scheme?
If not, I completely do not understand the inequation you wrote, which seemingly lists SHA-256 (and -512) multiple times.
- faceplanted 7y ago"SHA-512/256" is a single entity
- timdumol 7y agoYou're probably confused by "SHA-512/256", which does not mean SHA-512 or 256, but rather a truncated version of SHA-512: https://en.wikipedia.org/wiki/SHA-2 https://en.wikipedia.org/wiki/SHA-2 in the third paragraph.
- Ajedi32 7y agoSo why would a truncated version of SHA-512 be better than SHA-512? And why is SHA-512 = SHA-256?
- CiPHPerCoder 7y agoTruncated hash functions are not vulnerable to length-extension attacks. Length-extension attacks are relevant when you design a MAC by passing a secret and then a message to a hash function, where only the message is known. Truncating the hash (which is what SHA-512/256 and SHA-384 do to SHA-512) removes the ability to grab an existing hash H(k || m) (where k is unknown and m might be known) and append junk because a truncated hash does not contain sufficient information to recover the full state of the hash function in order to append new blocks.
- p1mrx 7y agoWhy do SHA-512/160 and SHA-512/128 not exist? They could be useful as drop-in replacements for SHA1 and MD5.
- tedunangst 7y agoYou can truncate a hash anywhere you like. But 128 bits is considered too short now.
- SAI_Peregrinus 7y agoBecause 224 bits is considered the minimum safe output length for a general purpose hash function. So they'd be drop-in replacements but still wouldn't be safe. Safer than MD5/SHA1, but not actually safe. So rather than push off getting people to make things actually safe by providing a footgun NIST just didn't do that.
- p1mrx 7y ago> 224 bits is considered the minimum safe output length for a general purpose hash function. Considered by whom?
- CiPHPerCoder 7y agoTruncating a hash function to 224 bits put it at the 112-bit security level, which is roughly equivalent to 2048-bit RSA under today's understanding of the costs of distributed cracking attacks. There are a lot of standards organizations all over the world with various recommendations. https://www.keylength.com https://www.keylength.com collates quite a few of them. Pick the one most closely relevant for your jurisdiction. Most of them recommend 2048-bit RSA as their minimum for asymmetric security, and AES-128 / SHA-256 as their minimum for symmetric security. This is a [112, 128]-bit security lower bound. Truncating a hash to 160 bits yields 80-bit security, which is insufficient. 128 bits (64-bit security) is out of the question.
- p1mrx 7y ago"Cryptographic hash functions with output size of n bits usually have a collision resistance security level n/2 and preimage resistance level n." Depending on what you're doing, "SHA-512/128" could have a 128-bit security level. But I guess it's safer to assume n/2 when making a general recommendation.
- deleted 7y ago[deleted]
- colanderman 7y agoAh! Makes sense now, thanks.
- dlgeek 7y agoSHA-512/256 is a truncated SHA-512 that's shortened to 256 bits, it's a separate standard.
- deleted 7y ago[deleted]
- CiPHPerCoder 7y agoI've edited my parent comment to consistently use hyphens. There are six SHA-2 family hash functions: * SHA-224 * SHA-256 * SHA-384 * SHA-512 * SHA-512/224 * SHA-512/256 Hope that helps. (I know it's still confusing.)