4

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would this cause? Would it be easier to find collisions, preimages, etc? Would it be possible to insert backdoors?

So far, I've only found one example, as specified here (Using SHA-256 with different initial hash value):

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.

Are there any other examples of potential weaknesses/attacks that would ensue if I allow the attacker to choose arbitrary IVs for the SHA256 hash function?

kelalaka
  • 49,797
  • 12
  • 123
  • 211
Biology nerd
  • 153
  • 6

1 Answers1

4

Would it be easier to find collisions, preimages, etc?

First note that if you can find preimages for a compressing function (like a hash) you can also find collisions. This means if we can't find collisions, then we also can't find preimages and thelike.

Now, the scenario you are describing is called a "freestart collision attack". Freestart collisions are one of the first signs that a hash functions has a serious flaw, e.g. a freestart collision was found for SHA-1 a couple of years before the full collision. Such a collision would utterly destroy our current faith in SHA-256 and is thus unlikely to be found.

Also note that the quoted passage talks about a variant of SHA-256 that removes the length padding to describe an attack. This attack is prevented by the length padding (and is the main reason why it's there).

SEJPM
  • 46,697
  • 9
  • 103
  • 214