1

Say I have a message m.

m1 = sha256(m)

m2 = sha224(m)

Is there any relationship between m1 and m2? If I'm trying to hide the value of m, can a third party guess at m if they have these two values? I'm assuming the answer is no, but just want to make sure there are no caveats.

The reason I want to use two different hashing functions on the same message is to generate two keys that are different but still related to the same data.

Improve this question

2 Answers 2

Reset to default
2

From Wikipedia:

SHA-224 is identical to SHA-256, except that: the initial hash values h0 through h7 are different, and the output is constructed by omitting h7.

So there's no exploitable relationship between m1 and m2, it's not easier to guess m from m1, m2 or both of them.

However, what you really want is a key derivation function. Do not roll your own crypto and do not reinvent the wheel.

Improve this answer
10
  • How does a KDF help here? From what I understand, it generates a key from a passphrase, salt, and iteration count. How would KDF help me generate two keys from the same passphrase?
    – Snowman
    Commented Nov 17, 2016 at 15:47
  • m1 = KDF(m, whatever, 1); m2 = KDF(m, whatever, 2)
    – A. Hersean
    Commented Nov 17, 2016 at 15:49
  • Can salts be the same for both? I ask because this will be done client side, so I can't save random salts to any db. So: m1 = KDF(m, "email", 1); m2 = KDF(m, "email", 2). Given m1, can m2 be derived? And given m2, can m1 be derived?
    – Snowman
    Commented Nov 17, 2016 at 15:55
  • For a better suggestion, use bcrypt as the KDF, with a different salt for each output.
    – A. Hersean
    Commented Nov 17, 2016 at 15:55
  • 1
    @maq If you've already key-stretched the input m, do not use PBKDF2, bcrypt, scrypt, or any other KDF with key stretching built in. And if you haven't, you should; there's no benefit to key-stretching twice to get two different keys. Stretch once, then use that key to feed another KDF (like HMAC) to get your two distinct keys.
    – Reid Rankin
    Commented Nov 17, 2016 at 16:04
1

Don't do that. At a minimum, use HMAC-SHA-256 with a different key for each purpose.

Really, though, you should use a proper KDF for this; I like HKDF, personally.

Improve this answer
2
  • How does a KDF help here? From what I understand, it generates a key from a passphrase, salt, and iteration count. How would KDF help me generate two keys from the same passphrase?
    – Snowman
    Commented Nov 17, 2016 at 15:46
  • You're thinking of PBKDF2 or another password-based KDF. Those take an iteration count and are purposely slow. HKDF is an example of a general KDF; it does not perform key stretching, and takes "input key material" instead of a passphrase. Feed it the key material you have, whatever length, and a different "info" value (salt) for each different key you want out. Then you can get exactly the number of bytes you need out of it, however many that is.
    – Reid Rankin
    Commented Nov 17, 2016 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .