Problem - Kevin Tafuro

SHA-256, SHA-384, SHA-512
After the announcement of AES, NIST moved to standardize hash algorithms that,
when considering the birthday attack, offer comparable levels of security to AES-
128, AES-192, and AES-256. The result was SHA-256, SHA-384, and SHA-512.
SHA-384 is merely SHA-512 with a truncated digest value, and it therefore isn’t
very interesting in and of itself.
These algorithms are designed in a very conservative manner, and therefore their
speed is closer to that expected from a block cipher than that expected from a
traditional cryptographic message digest function. Clearly, if birthday-style
attacks are not an issue (usually due to proper use of nonce), then AES-256 and
SHA-256 offer equivalent security margins, making SHA-384 and SHA-512 overkill.
In such a scenario, SHA1 is an excellent algorithm to pair with AES-128. In
practice, a nonce is a good idea, and we therefore recommend AES-128 and
SHA1 when you want to use a block cipher and a separate message digest algorithm.
Note also that performance numbers for SHA-384 and SHA-512 would
improve on a platform with native 64-bit operations.
The cryptographic hash function constructs based on block ciphers not only tend to
run more slowly than dedicated functions, but also they rely on assumptions that are
a bit unusual. In particular, these constructions demand that the underlying cipher
resist related-key attacks, which are relatively unstudied compared with traditional
attacks. On the other hand, dedicated hash functions have received a whole lot less
scrutiny from the cryptanalysts in the world—assuming that SHA1 acts like a
pseudo-random function (or close to it) is about as dicey.
In practice, if you really need to use a one-way hash function, we believe that SHA1
is suitable for almost all needs, particularly if you are savvy about thwarting birthday
attacks and collision attacks on the block cipher (see Recipe 5.3). If you’re using AES
with 128-bit keys, SHA1 makes a reasonable pairing. However, if you ever feel the
need to use stronger key sizes (which is quite unnecessary for the foreseeable future),
you should also switch to SHA-256.
See Also
Recipes 5.3, 6.5-6.8, 6.15, 6.16
6.4 Choosing a Message Authentication Code
Problem
You need to use a MAC (which yields a tag that can only be computed correctly on a
piece of data by an entity with a particular secret key), and you want to understand
the important concerns so you can determine which algorithm best suits your needs.
258 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.