"The proposed attacker knows all the inputs to the SHA-512 hash and therefore does not need to reverse the hash." Knowing the inputs to the SHA-512 hash does n

"The proposed attacker knows all the inputs to the SHA-512 hash and therefore does not need to reverse the hash." Knowing the inputs to the SHA-512 hash does not give you the ability to influence the outputs. So, you won't be able to influence the results (greatly - exceptions can be made for small things like changing the odd/even of the next digit - but that ability disappears further down the chain), but, presumably, you will know what they are. I think the presumption should be that there is some agency that knows all the values in the NIST chain for the forseeable future, and no important system should be designed in the belief that those values aren't known. What does make sense though, is taking a third-party trusted system (as suggested by the NIST), and adding that to the hash string. Something as simple as the latest block for a particular day from blockchain would be sufficient. In fact, all it really needs to be is something numeric - like the closing price of the S&P 500 would do the trick. That would prevent the NIST from calculating any further than one day in advance, and even then - They could only target you.