1

Say I have a message m.

m1 = sha256(m)

m2 = sha224(m)

Is there any relationship between m1 and m2? If I'm trying to hide the value of m, can a third party guess at m if they have these two values? I'm assuming the answer is no, but just want to make sure there are no caveats.

The reason I want to use two different hashing functions on the same message is to generate two keys that are different but still related to the same data.

2

From Wikipedia:

SHA-224 is identical to SHA-256, except that: the initial hash values h0 through h7 are different, and the output is constructed by omitting h7.

So there's no exploitable relationship between m1 and m2, it's not easier to guess m from m1, m2 or both of them.

However, what you really want is a key derivation function. Do not roll your own crypto and do not reinvent the wheel.

| improve this answer | |
  • How does a KDF help here? From what I understand, it generates a key from a passphrase, salt, and iteration count. How would KDF help me generate two keys from the same passphrase? – Snowman Nov 17 '16 at 15:47
  • m1 = KDF(m, whatever, 1); m2 = KDF(m, whatever, 2) – A. Hersean Nov 17 '16 at 15:49
  • Can salts be the same for both? I ask because this will be done client side, so I can't save random salts to any db. So: m1 = KDF(m, "email", 1); m2 = KDF(m, "email", 2). Given m1, can m2 be derived? And given m2, can m1 be derived? – Snowman Nov 17 '16 at 15:55
  • For a better suggestion, use bcrypt as the KDF, with a different salt for each output. – A. Hersean Nov 17 '16 at 15:55
  • 1
    @maq If you've already key-stretched the input m, do not use PBKDF2, bcrypt, scrypt, or any other KDF with key stretching built in. And if you haven't, you should; there's no benefit to key-stretching twice to get two different keys. Stretch once, then use that key to feed another KDF (like HMAC) to get your two distinct keys. – Reid Rankin Nov 17 '16 at 16:04
1

Don't do that. At a minimum, use HMAC-SHA-256 with a different key for each purpose.

Really, though, you should use a proper KDF for this; I like HKDF, personally.

| improve this answer | |
  • How does a KDF help here? From what I understand, it generates a key from a passphrase, salt, and iteration count. How would KDF help me generate two keys from the same passphrase? – Snowman Nov 17 '16 at 15:46
  • You're thinking of PBKDF2 or another password-based KDF. Those take an iteration count and are purposely slow. HKDF is an example of a general KDF; it does not perform key stretching, and takes "input key material" instead of a passphrase. Feed it the key material you have, whatever length, and a different "info" value (salt) for each different key you want out. Then you can get exactly the number of bytes you need out of it, however many that is. – Reid Rankin Nov 17 '16 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.