4 ms·

> If you can get away with it: use SHA-512/256, which truncates its output and sidesteps length extension attacks. Note that "SHA-512/256" is a separate algori

> If you can get away with it: use SHA-512/256, which truncates its output and sidesteps length extension attacks. Note that "SHA-512/256" is a separate algorithm, not to be confused with "SHA-512 or SHA-256" which are two other less secure algorithms.

erkl 11y ago
Unless you know something about SHA-512 that I don't, calling it less secure than SHA-512/256 seems like a mistake.
- nialo 11y ago
  SHA-512 allows a length extension attack that SHA-512/256 does not. Some links: http://en.wikipedia.org/wiki/Length_extension_attack http://en.wikipedia.org/wiki/Length_extension_attack http://cryptopals.com/sets/4/challenges/29/ http://cryptopals.com/sets/4/challenges/29/
  - erkl 11y ago
    First off, thanks for the reply. I have to say it feels a bit weird to deduct points (so to speak) from a highly regarded cryptographic hash function because it doesn't outright prevent one particular, broken MAC generation scheme, but I guess the argument has some merit. While I think it's harmless to say that SHA-512/256 is stronger than SHA-256 (as they otherwise provide the same theoretical level of security), I still think it's wrong to claim that SHA-512/256 is also stronger than SHA-512, which has a vastly greater theoretical security margin. Just use a MAC algorithm that isn't terrible.
    - tptacek 11y ago
      Susceptibility to length extension would also have disqualified SHA2-512 from SHA-3, where that property was a requirement, so it seems like the cryptographic community has come to conclusion about this. The "security margin" of a full SHA2-512 digest, over its truncated SHA2-512/256 alternative, is not meaningful in practice. If you want to use full-width SHA2-512, go ahead. SHA2-512/256 is safer.
    - alextgordon 11y ago
      Devil's advocate: 10 years from now if SHA-3 is dominant and HMAC has faded into obscurity, how hard will it be to get programmers to understand the difference between hash function and MAC? Keeping in mind that they barely understand today.
  - deleted 11y ago
    [deleted]
tedunangst 11y ago
SHA384 has many of the same properties and is less ambiguous if you care about interoperability. Most libraries require you to truncate 512-256 yourself (not difficult, but still work).

erkl 11y ago

Unless you know something about SHA-512 that I don't, calling it less secure than SHA-512/256 seems like a mistake.

nialo 11y ago
SHA-512 allows a length extension attack that SHA-512/256 does not. Some links: http://en.wikipedia.org/wiki/Length_extension_attack http://en.wikipedia.org/wiki/Length_extension_attack http://cryptopals.com/sets/4/challenges/29/ http://cryptopals.com/sets/4/challenges/29/
- erkl 11y ago
  First off, thanks for the reply. I have to say it feels a bit weird to deduct points (so to speak) from a highly regarded cryptographic hash function because it doesn't outright prevent one particular, broken MAC generation scheme, but I guess the argument has some merit. While I think it's harmless to say that SHA-512/256 is stronger than SHA-256 (as they otherwise provide the same theoretical level of security), I still think it's wrong to claim that SHA-512/256 is also stronger than SHA-512, which has a vastly greater theoretical security margin. Just use a MAC algorithm that isn't terrible.
  - tptacek 11y ago
    Susceptibility to length extension would also have disqualified SHA2-512 from SHA-3, where that property was a requirement, so it seems like the cryptographic community has come to conclusion about this. The "security margin" of a full SHA2-512 digest, over its truncated SHA2-512/256 alternative, is not meaningful in practice. If you want to use full-width SHA2-512, go ahead. SHA2-512/256 is safer.
  - alextgordon 11y ago
    Devil's advocate: 10 years from now if SHA-3 is dominant and HMAC has faded into obscurity, how hard will it be to get programmers to understand the difference between hash function and MAC? Keeping in mind that they barely understand today.
- deleted 11y ago
  [deleted]

tedunangst 11y ago

SHA384 has many of the same properties and is less ambiguous if you care about interoperability. Most libraries require you to truncate 512-256 yourself (not difficult, but still work).