Cryptology ePrint Archive: Report 2016/374

Analysis of SHA-512/224 and SHA-512/256

Christoph Dobraunig and Maria Eichlseder and Florian Mendel

Abstract: In 2012, NIST standardized SHA-512/224 and SHA-512/256, two truncated variants of SHA-512, in FIPS 180-4. These two hash functions are faster than SHA-224 and SHA-256 on 64-bit platforms, while maintaining the same hash size and claimed security level. So far, no third-party analysis of SHA-512/224 or SHA-512/256 has been published. In this work, we examine the collision resistance of step-reduced versions of SHA-512/224 and SHA-512/256 by using differential cryptanalysis in combination with sophisticated search tools. We are able to generate practical examples of free-start collisions for 44-step SHA-512/224 and 43-step SHA-512/256. Thus, the truncation performed by these variants on their larger state allows us to attack several more rounds compared to the untruncated family members. In addition, we improve upon the best published collisions for 24-step SHA-512 and present practical collisions for 27 steps of SHA-512/224, SHA-512/256, and SHA-512.

Category / Keywords: secret-key cryptography / hash functions, cryptanalysis, collisions, free-start collisions, SHA-512/224, SHA-512/256, SHA-512, SHA-2

Original Publication (with major differences): IACR-ASIACRYPT-2015

Date: received 13 Apr 2016

Contact author: maria eichlseder at iaik tugraz at

Available format(s): PDF | BibTeX Citation

Version: 20160414:200909 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]