9 ms·

You're probably confused by "SHA-512/256", which does not mean SHA-512 or 256, but rather a truncated version of SHA-512: https://en.wikipedia.org/wiki/SHA-2 ht

You're probably confused by "SHA-512/256", which does not mean SHA-512 or 256, but rather a truncated version of SHA-512: https://en.wikipedia.org/wiki/SHA-2 https://en.wikipedia.org/wiki/SHA-2 in the third paragraph.

Ajedi32 7y ago
So why would a truncated version of SHA-512 be better than SHA-512? And why is SHA-512 = SHA-256?
- CiPHPerCoder 7y ago
  Truncated hash functions are not vulnerable to length-extension attacks. Length-extension attacks are relevant when you design a MAC by passing a secret and then a message to a hash function, where only the message is known. Truncating the hash (which is what SHA-512/256 and SHA-384 do to SHA-512) removes the ability to grab an existing hash H(k || m) (where k is unknown and m might be known) and append junk because a truncated hash does not contain sufficient information to recover the full state of the hash function in order to append new blocks.
  - p1mrx 7y ago
    Why do SHA-512/160 and SHA-512/128 not exist? They could be useful as drop-in replacements for SHA1 and MD5.
    - tedunangst 7y ago
      You can truncate a hash anywhere you like. But 128 bits is considered too short now.
    - SAI_Peregrinus 7y ago
      Because 224 bits is considered the minimum safe output length for a general purpose hash function. So they'd be drop-in replacements but still wouldn't be safe. Safer than MD5/SHA1, but not actually safe. So rather than push off getting people to make things actually safe by providing a footgun NIST just didn't do that.
      - p1mrx 7y ago
        > 224 bits is considered the minimum safe output length for a general purpose hash function. Considered by whom?
        CiPHPerCoder 7y ago
        Truncating a hash function to 224 bits put it at the 112-bit security level, which is roughly equivalent to 2048-bit RSA under today's understanding of the costs of distributed cracking attacks. There are a lot of standards organizations all over the world with various recommendations. https://www.keylength.com https://www.keylength.com collates quite a few of them. Pick the one most closely relevant for your jurisdiction. Most of them recommend 2048-bit RSA as their minimum for asymmetric security, and AES-128 / SHA-256 as their minimum for symmetric security. This is a [112, 128]-bit security lower bound. Truncating a hash to 160 bits yields 80-bit security, which is insufficient. 128 bits (64-bit security) is out of the question.
        p1mrx 7y ago
        "Cryptographic hash functions with output size of n bits usually have a collision resistance security level n/2 and preimage resistance level n." Depending on what you're doing, "SHA-512/128" could have a 128-bit security level. But I guess it's safer to assume n/2 when making a general recommendation.
        deleted 7y ago
        [deleted]
- deleted 7y ago
  [deleted]
colanderman 7y ago
Ah! Makes sense now, thanks.

Ajedi32 7y ago

So why would a truncated version of SHA-512 be better than SHA-512? And why is SHA-512 = SHA-256?

CiPHPerCoder 7y ago
Truncated hash functions are not vulnerable to length-extension attacks. Length-extension attacks are relevant when you design a MAC by passing a secret and then a message to a hash function, where only the message is known. Truncating the hash (which is what SHA-512/256 and SHA-384 do to SHA-512) removes the ability to grab an existing hash H(k || m) (where k is unknown and m might be known) and append junk because a truncated hash does not contain sufficient information to recover the full state of the hash function in order to append new blocks.
- p1mrx 7y ago
  Why do SHA-512/160 and SHA-512/128 not exist? They could be useful as drop-in replacements for SHA1 and MD5.
  - tedunangst 7y ago
    You can truncate a hash anywhere you like. But 128 bits is considered too short now.
  - SAI_Peregrinus 7y ago
    Because 224 bits is considered the minimum safe output length for a general purpose hash function. So they'd be drop-in replacements but still wouldn't be safe. Safer than MD5/SHA1, but not actually safe. So rather than push off getting people to make things actually safe by providing a footgun NIST just didn't do that.
    - p1mrx 7y ago
      > 224 bits is considered the minimum safe output length for a general purpose hash function. Considered by whom?
      - CiPHPerCoder 7y ago
        Truncating a hash function to 224 bits put it at the 112-bit security level, which is roughly equivalent to 2048-bit RSA under today's understanding of the costs of distributed cracking attacks. There are a lot of standards organizations all over the world with various recommendations. https://www.keylength.com https://www.keylength.com collates quite a few of them. Pick the one most closely relevant for your jurisdiction. Most of them recommend 2048-bit RSA as their minimum for asymmetric security, and AES-128 / SHA-256 as their minimum for symmetric security. This is a [112, 128]-bit security lower bound. Truncating a hash to 160 bits yields 80-bit security, which is insufficient. 128 bits (64-bit security) is out of the question.
        p1mrx 7y ago
        "Cryptographic hash functions with output size of n bits usually have a collision resistance security level n/2 and preimage resistance level n." Depending on what you're doing, "SHA-512/128" could have a 128-bit security level. But I guess it's safer to assume n/2 when making a general recommendation.
        deleted 7y ago
        [deleted]
deleted 7y ago
[deleted]

colanderman 7y ago

Ah! Makes sense now, thanks.