Secure Hash Algorithm - SHA

In recent years, the most widely used hash function has been the Secure Hash Algorithm (SHA).SHA was developed by the National Institute of Standards and Technology (NIST) and published as a federal information processing standard (FIPS 180) in 1993. When weaknesses were discovered in SHA, now known as SHA-0, a revised version was issued as FIPS 180-1 in 1995 and is referred to as SHA-1. The actual standards document is entitled “Secure Hash Standard.” SHA is based on the hash function MD4, and its design closely models MD4.

SHA-1 produces a hash value of 160 bits. In 2002, NIST produced a revised version of the standard, FIPS 180-2, that defined three new versions of SHA, with hash value lengths of 256, 384, and 512 bits, known as SHA-256, SHA-384, and SHA-512, respectively. Collectively, these hash algorithms are known as SHA-2.These new versions have the same underlying structure and use the same types of modular arithmetic and logical binary operations as SHA-1.In 2005, NIST announced the intention to phase out approval of SHA-1 and move to a reliance on SHA-2 by 2010. Shortly thereafter, a research team described an attack in which two separate messages could be found that deliver the same SHA-1 hash using $2^{69}$ operations, far fewer than the $2^{80}$ operations previously thought needed to find a collision with an SHA-1 hash . This result should hasten the transition to SHA-2.

In this section, we provide a description of SHA-512. The other versions are quite similar.

SHA-512 Logic

The algorithm takes as input a message with a maximum length of less than $2^{128}$ bits and produces as output a 512-bit message digest. The input is processed in 1024-bit blocks. Figure 11.9 depicts the overall processing of a message to produce a digest.

Step 1 Append padding bits. The message is padded so that its length is congruent to 896 modulo 1024 [length  =896(mod 1024)]. Padding is always added, even if the message is already of the desired length. Thus, the number of padding bits is in the range of 1 to 1024. The padding consists of a single 1 bit followed by the necessary number of 0 bits.

Step 2 Append length. A block of 128 bits is appended to the message. This block is treated as an unsigned 128-bit integer (most significant byte first) and contains the length of the original message in bits (before the padding). 

The outcome of the first two steps yields a message that is an integer multiple of 1024 bits in length. In Figure 11.9, the expanded message is represented as the sequence of 1024-bit blocks $M_1, M_2, \ldots, M_N$, so that the total length of the expanded message is $N * 1024$ bits.

Step 3 Initialize hash buffer. A 512-bit buffer is used to hold intermediate and final results of the hash function. The buffer can be represented as eight 64-bit registers ($a, b, c, d, e, f, g, h$). These registers are initialized to the following 64-bit integers (hexadecimal values):

a = 6A09E667F3BCC908     e = 510E527FADE682D1

b = BB67AE8584CAA73B  f = 9B05688C2B3E6C1F

c = 3C6EF372FE94F82B     g = 1F83D9ABFB41BD6B

d = A54FF53A5F1D36F1     h = 5BE0CD19137E2179

These values are stored in big-endian format, which is the most significant byte of a word in the low-address (leftmost) byte position. These words were obtained by taking the first sixty-four bits of the fractional parts of the square roots of the first eight prime numbers 

Step 4 Process message in 1024-bit (128-byte) blocks. The heart of the algorithm is a module that consists of 80 rounds; this module is labeled F in Figure 11.9.The logic is illustrated in Figure 11.10

Each round takes as input the 512-bit buffer value, abcdefgh, and updates the contents of the buffer. At input to the first round, the buffer has the value of the intermediate hash value, $H-{i-1}$. Each round $t$ makes use of a 64-bit value $W_t$, derived from the current 1024-bit block being processed ($M_i$). These values are derived using a message schedule described subsequently. Each round also makes use of an additive constant $K_t$, where $0 \le t \le 79$ indicates one of the 80 rounds. These words represent the first 64 bits of the fractional parts of the cube roots of the first 80 prime numbers.The constants provide a “randomized” set of 64-bit patterns, which should eliminate any regularities in the input data. 

The output of the eightieth round is added to the input to the first round ($H_{i-1}$) to produce $H_i$. The addition is done independently for each of the eight words in the buffer with each of the corresponding words in $H_{i-1}$, using addition modulo $2^{64}.$

Step 5 Output. After all $N$ 1024-bit blocks have been processed, the output from the $N$th stage is the 512-bit message digest.

We can summarize the behavior of SHA-512 as follows:

$H_0 = IV$

$H_i = SUM_{64}(H_{i-1}, abcdefghi)$

$MD = H_N$

where

$IV$ = initial value of the abcdefgh buffer, defined in step 3

abcdefghi = the output of the last round of processing of the ith message block

$N$ = the number of blocks in the message (including padding and length fields)

$SUM_{64}$ = addition modulo 264 performed separately on each word of the pair of inputs

$MD$ = final message digest value

It remains to indicate how the 64-bit word values Wt are derived from the 1024-bit message. Figure 11.12 illustrates the mapping. The first 16 values of $W_t$ are taken directly from the 16 words of the current block. The remaining values are defined as

Thus, in the first 16 steps of processing, the value of $W_t$ is equal to the corresponding word in the message block. For the remaining 64 steps, the value of $W_t$ consists of the circular left shift by one bit of the XOR of four of the preceding values of $W_t$, with two of those values subjected to shift and rotate operations.