Kangaroo Twelve Implementation in Go

Re:Kangaroo Twelve Implementation in Go by snakeanus on Sunday June 11, 2017 @01:53PM (#14532935)

This is wrong, SHA-512/256 is not the same as calculating the output of SHA-512 and then taking the first 256 bits of it, there are some differences between them such as different IVs that would make the outputs also different.

[ Parent | on HN ]

Re:Kangaroo Twelve Implementation in Go by wolf550e on Sunday June 11, 2017 @02:10PM (#14533014)

Yes, sorry. You need to overwrite the initial value (H0) too, in the constructor. You can do that if you can touch the equivalent of the private member variables.

    SHA-512/256 may be used to hash a message, M, having a length of 𝓁 bits, where 128 0 ≤ 𝓁 < 2.
    The algorithm is defined in the exact same manner as SHA-512 (Sec. 6.4), with the following two exceptions:
    1. The initial hash value, H(0), shall be set as specified in Sec. 5.3.6.2; and
    2. The 256-bit message digest is obtained by truncating the final hash value, H(N), to its left-most 256 bits.

(from §6.7 in http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4....)

EDIT: I trust 'tptacek (in sibling comment) that if there is no chance of protocol confusion, there is no advantage to the different initial value.

[ Parent | on HN ]

Re:Kangaroo Twelve Implementation in Go by tptacek on Sunday June 11, 2017 @02:13PM (#14533025)

This only matters if there's an existing protocol that uses truncated SHA-2 you need to interoperate with (and your premise is there is not).

There is no functional advantage to having a different IV for SHA-2 5-2/256.

[ Parent | on HN ]

Re:Kangaroo Twelve Implementation in Go by baby on Sunday June 11, 2017 @02:51PM (#14533182)

Yup, this looks like it's a cross-domain protection.

[ Parent | on HN ]

Re:Kangaroo Twelve Implementation in Go by tptacek on Sunday June 11, 2017 @03:02PM (#14533224)

Sure, but if you care about domain separation, you can't rely on the IV anyways.

[ Parent | on HN ]