↓ Skip to main content
Le Site de François
  1. Index/

SHA (Secure Hash Algorithm)

Cryptography Security Hash Nist Primitives Pqc

SHA (Secure Hash Algorithm) is the name given to a series of cryptographic hash function families standardised by NIST under FIPS 180 and FIPS 202. Three generations exist with fundamentally different design lineages. SHA-1 (1995, FIPS 180-1) produces a 160-bit digest and is fully broken for collision resistance: the SHAttered attack (Google and CWI Amsterdam, 2017) produced a chosen-prefix collision — two different PDF files with identical SHA-1 hashes — using approximately 9.2 × 10^18 SHA-1 operations, within practical reach of well-resourced attackers. SHA-1 must not be used for any security purpose; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git’s object store in favour of SHA-256 under the sha256 object format) and in TOTP’s HMAC-SHA-1 inner construction (where collision resistance is not the relevant security property, but migration to SHA-256 variants is still recommended). SHA-2 (2001, FIPS 180-2 and subsequent revisions) is the Merkle-Damgård family that includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. SHA-256 and SHA-512 are the two variants in universal production use; the others serve niche roles. SHA-3 (2015, FIPS 202) is the Keccak sponge construction — structurally independent of SHA-2 — providing algorithm diversity and including fixed-output variants (SHA3-256, SHA3-512) and extendable output functions (SHAKE128, SHAKE256).

SHA-256 (256-bit digest, part of SHA-2) is the universal default hash function in modern infrastructure. It is used in: TLS certificate fingerprints and the signature algorithm ecdsa-with-SHA256 in X.509 certificates; OCI and composefs content-addressed storage where every blob is identified by its sha256: digest; LUKS2 header integrity protection; the PBKDF2 and Argon2 key derivation functions used in password storage and disk encryption; HMAC-SHA-256 for message authentication and API signing; HKDF-SHA-256 for key derivation in TLS 1.3 and ML-KEM output processing; Git object hashing (under migration); and as the inner hash in ML-DSA and ML-KEM parameter sets. SHA-384 (truncated SHA-512 with a different initialisation vector) produces a 384-bit digest and is mandated by NSA CNSA 1.0 for top-secret data; it is the hash algorithm in ecdsa-with-SHA384 signatures on P-384 certificates and in TLS 1.3’s TLS_AES_256_GCM_SHA384 cipher suite. SHA-512 produces a 512-bit digest with the same Merkle-Damgård structure as SHA-256 but a larger internal state (512-bit vs 256-bit) and 80 rounds vs 64; it is used where the largest classical security margin is required and in IMA file measurements at the SHA-512 attribute level. SHA-512 is faster than SHA-256 on 64-bit CPUs for long messages because both process one block per iteration, but SHA-512’s block is 1024 bits vs SHA-256’s 512 bits; for short messages (certificates, JWTs, API payloads), SHA-256 is faster in absolute terms.

SHA-3 (Keccak, FIPS 202) uses a sponge construction: a fixed-size state (1600 bits) is iteratively permuted with the Keccak-f permutation, absorbing input in chunks and squeezing output after. This is structurally independent of the Merkle-Damgård construction used by SHA-1 and SHA-2 — a weakness specific to Merkle-Damgård (such as length-extension attacks, which affect naive H(K ∥ m) constructions with SHA-256) does not apply to Keccak. SHA3-256 and SHA3-512 are drop-in replacements for SHA-256 and SHA-512 with identical output sizes; SHAKE128 and SHAKE256 are extendable output functions (XOFs) that produce an output of any requested length, making them the natural primitive for protocols that need variable-length pseudorandom output. SHAKE128 and SHAKE256 are used internally in ML-KEM, ML-DSA, and SLH-DSA (in their SHAKE-based parameter sets) as the pseudorandom generation primitive, and in OpenSSL 3.x as the underlying XOF for HKDF variants. Against quantum computers, all SHA-2 and SHA-3 variants are affected only by Grover’s algorithm, which halves the effective security level against preimage attacks: SHA-256 provides 128-bit quantum preimage security (adequate), SHA-384 provides 192-bit (conservative), SHA-512 provides 256-bit (maximum). Collision resistance under quantum attack is governed by the BHT (Brassard-Høyer-Tapp) algorithm, which reduces collision resistance to approximately two-thirds of the classical level — SHA-256 provides roughly 170-bit quantum collision resistance, SHA-384 roughly 256-bit. The practical implication is that SHA-256 remains safe for all current uses in the PQC transition; SHA-384 or SHA-512 is the conservative choice for new high-assurance deployments with long lifetimes, and SHA-3/SHAKE is preferred where design diversity from SHA-2 is valued.

Related

AES (Advanced Encryption Standard)

Cryptography Symmetric Encryption Nist Security Primitives
AES (Advanced Encryption Standard), standardised as NIST FIPS 197 in 2001, is the symmetric block cipher that underlies virtually all data encryption in modern infrastructure. It was selected through a five-year open competition that evaluated 15 candidate algorithms; the winner, Rijndael (designed by Joan Daemen and Vincent Rijmen), became AES. A block cipher takes a fixed-size block of plaintext and a key and produces a fixed-size block of ciphertext — AES always operates on 128-bit (16-byte) blocks, regardless of key size. Three key lengths are standardised: AES-128 (128-bit key, 10 rounds), AES-192 (192-bit key, 12 rounds), and AES-256 (256-bit key, 14 rounds), providing 128, 192, and 256 bits of security respectively against classical attacks. AES-256 is the conservative choice for data with long confidentiality requirements and is mandated by CNSA 2.0 for national security systems; AES-128 is widely deployed in TLS and provides adequate security for most workloads. The internal structure — SubBytes, ShiftRows, MixColumns, AddRoundKey — is fully public and has withstood over two decades of cryptanalysis; the best known attacks against full-round AES are theoretical and computationally infeasible, requiring work far beyond brute force but not threatening practical security.

Hash Function (Cryptographic Hash Function)

Cryptography Security Primitives Integrity Pqc
A cryptographic hash function maps an input of arbitrary length (a file, a certificate, a password, a block of network data) to a fixed-length digest (also called a hash or fingerprint) with three security properties that distinguish it from non-cryptographic checksums. Preimage resistance: given a digest h, it is computationally infeasible to find any input m such that H(m) = h. Second preimage resistance: given an input m1, it is computationally infeasible to find a different input m2 such that H(m1) = H(m2). Collision resistance: it is computationally infeasible to find any pair (m1, m2) with m1 ≠ m2 such that H(m1) = H(m2). Collision resistance is the strongest property and implies second preimage resistance but not preimage resistance. These properties together make a hash function a one-way, tamper-evident fingerprint: two inputs that produce the same digest cannot be found by an adversary, and knowing the digest reveals nothing about the input beyond its length.

Diffie-Hellman (DH / ECDH / X25519)

Cryptography Key-Exchange Tls Pqc Primitives Ecc
Diffie-Hellman (DH) is a key exchange protocol published by Whitfield Diffie and Martin Hellman in 1976 — the first public description of asymmetric cryptography and one of the most consequential cryptographic publications in history. Its fundamental contribution is solving the key establishment problem: two parties who have never communicated before, communicating over a channel that an adversary can fully observe, can nonetheless agree on a shared secret that the adversary cannot determine. The security of finite-field DH rests on the discrete logarithm problem: given g^a mod p and g^b mod p (the public values exchanged), computing g^ab mod p (the shared secret) requires solving for either a or b, which is computationally infeasible for sufficiently large groups. The 1976 original uses multiplicative groups of integers modulo a prime p; the security level is determined by the size of p (currently 2048-bit minimum, 3072-bit recommended) and the group’s structure. Finite-field DH is still deployed in TLS 1.2 DHE cipher suites and legacy IPsec configurations, but has been supplanted in new deployments by Elliptic Curve Diffie-Hellman (ECDH) and specifically by X25519, which provide equivalent security at dramatically smaller key sizes.