Re:The first chosen-prefix collision for SHA-1
by fireflash38 on Tuesday January 07, 2020 @10:45AM
(#21981012)
I read the blog, but it doesn't really expand on why SHA224/384 aren't vulnerable to that attack, can you explain (or link to some place that does?)
[ Parent
| on HN ]
Re:The first chosen-prefix collision for SHA-1
by tptacek on Tuesday January 07, 2020 @12:35PM
(#21982243)
A length-extension attack works by taking the output of a hash and using it as the starting point for a new hash; you can do this even for hashes of messages you haven't seen, minting new related hashes. Truncated SHA-2 hashes don't output the whole hash, and so you aren't given enough information to start a new related hash.
Re:The first chosen-prefix collision for SHA-1
by CiPHPerCoder on Tuesday January 07, 2020 @11:25AM
(#21981426)
Because they're already truncated.
SHA-384 is SHA-512 with a different IV (which doesn't affect LEAs) truncated to 384 bits (which gives you 128 bits of resistance against LEAs).
SHA-224 is the same story but with SHA-256 instead (and only 32 bits of LEA resistance).