SHA Demystified: How Secure Is 256-Bit Hashing?
WHAT IS SHA-256?
SHA (Secure Hash Algorithm) is a family of five algorithms accepted by FIPS used to transform a given piece of data into a fixed-length piece of data with a high probability of difference.
The SHA algorithms are cryptographic hash algorithms developed by the US National Security Agency (NSA) and published as a US government standard by the US National Institute of Standards and Technology (NIST)
The five standard SHA algorithms are SHA-1 (returns a 160-bit result), SHA-224 (returns a 224-bit result), SHA-256 (returns a 256-bit result), SHA-384 (returns a 384-bit result), and SHA-512 (returns a 512-bit result).
These algorithms are called "secure" because, per the FIPS 180-2 standard issued on August 1, 2002:
"1) Given a hash value produced by one of the SHA algorithms, recovering the original data is infeasible. This is also called a one-way code,
2) Finding two different pieces of data with the same hash result produced by one of the SHA algorithms is infeasible.
3) Any change to the original data, however small, will produce a completely different hash value with very high probability."
Example of the SHA-256 code of a message:
APPLICATIONS
Since 2008, SHA has been used by STECH in SmartQMAN as the authentication code in every exchanged data packet (between software modules, and between on-site software and the centralized QMS Server management software). SHA codes are also used by STECH as license keys for software provided to customers. Secure protocols on today's internet, such as SSL and digital signatures, all use SHA hash functions.
However, SHA's most famous application must be the Bitcoin currency system, a distributed currency transaction system on the internet that uses SHA-256 codes to authenticate transactions and store a chain of historical events over time linked together by authentication codes (BlockChain).
HOW SECURE IS 256 BITS
The common use of the SHA one-way code is to create a message signature by hashing the string formed by concatenating the message to authenticate with a secret key; the secret key is generally very long:
Signature = SHA256("message to authenticate", "secret key") = hash
With the one-way property, the signature can be public, the message can be public, but the secret key component cannot be traced back, because recovering the full original data from the signature is impossible.
The only way to trace back the full original data is to try every possible secret key and every way the key is combined with the message to authenticate — which also means checking every possible input to find a signature matching the known signature; this method is called BruteForce. Without loss of generality, consider "secret key" = SHA256("secret-key") = 256 bits
Because every tiny change in the original data, however small, produces a completely different hash value with very high probability that cannot be predicted in advance, this check is a check over the entire space of hash values — that is, a BruteForce with 2256 possibilities.
So how hard is BruteForcing 2256?
2256 = 115792 089237316 195423570 985008687 907853269 984665640 564039457 584007913 129639936 > 1078
Assuming each 4GHz personal computer can process 1.4G hash operations per second, 1.4x109hash/s, and Earth has 7 billion people each with such a computer, the total computing power of Earth is: 1019hash/s. In reality, a 4GHz computer can only perform about 105hash/s, but this estimate does not lose its illustrative value.
In the Milky Way galaxy there are about 100 billion stars; assuming 1% of them have an Earth-like civilization, the hashing power of the Galaxy is: 1019hash/s x 1% x 100x109 = 1028hash/s
The observable universe is believed to have 100 billion galaxies, and the whole universe is believed to be 10 times larger, so the hashing power of the whole universe is: 1028hash/s x 100x109 x 10 = 1040hash/s
At this computing speed, to check all 1078 possibilities, the whole universe would need 1078 / 1040 = 1038 seconds ≈ 3.17098x1030 years, or ≈ 2.4x1020 times the age of the universe itself — in other words, infeasible.
That is why SHA-256 is considered very secure.
- source: dev@onyx.vn -