Re:The first chosen-prefix collision for SHA-1
by tptacek on Tuesday January 07, 2020 @12:44PM
(#21982361)
Cryptographic engineers do not in fact think you should use SHA-2-512 so that you can maximize the number of times the round function is applied.
Re:The first chosen-prefix collision for SHA-1
by jlokier on Tuesday January 07, 2020 @12:50PM
(#21982463)
I'm not sure what that sentence means, can you rephrase it?
Re:The first chosen-prefix collision for SHA-1
by tptacek on Tuesday January 07, 2020 @12:55PM
(#21982533)
The analysis you have provided for why SHA-512 is superior to SHA-256 is faulty.
Re:The first chosen-prefix collision for SHA-1
by jlokier on Tuesday January 07, 2020 @07:18PM
(#21986813)
The analysis was only supposed to explain why the 256-bit length of the hash output is not the sole determinant of a hash's strength. The parent was saying that, that's why it's quoted in my reply.
Pity it didn't come across that way.
The strength of hashes like SHA-256 doesn't just come from the number of output bits.
The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values.
SHA-512 performs more "rounds" of computation than SHA-256.
Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision.
If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered.
The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.