Feeds

US gov mulls changes to popular hashing algorithm

Tweaking SHA-2 for high performance systems

Beginner's guide to SSL certificates

The US government's custodian of cryptography standards has released two proposed changes to the SHA-2 hashing algorithm that are designed to boost performance on 64-bit systems.

The tweaks, published this week (PDF) by the National Institute of Standards and Technology, would update the 512-bit version of SHA-2, which was formally approved in 2008. Short for secure hashing algorithm 2, SHA-2's 224-, 256-, and 384-bit versions would remain unchanged. The public has until May 12 to comment on the proposal.

Like other hashing algorithms, SHA-2 is a cryptographic means for verifying that the contents of an email or computer file haven't been tampered with by unauthorized third parties. They work by generating a one-way hash that acts as a digital signature of sorts that is unique to a specific set of data. Higher bit rates improve the security of hashing algorithms by reducing the likelihood of “collisions,” in which two different inputs generate the same outputted hash. But the increased bit rates often come at the cost of higher computing overhead.

In a nutshell, the proposed updates known as SHA-512/224 and SHA-512/256 would yield the same increased security of SHA-2's 512-bit algorithm. But on systems optimized for 64-bit computing, they would reduce some of the performance requirements, essentially by truncating the output.

The new versions would also remove a restriction that padding must be done before hash computation begins. Instead, padding would be done on the fly, which can be advantageous in certain settings.

The proposed changes come as NIST has commissioned a competition to create a new hashing algorithm that is more cryptographically sound than current hash functions. In 2009, 14 candidates for the SHA-3 standard were chosen among the 51 initial entries.

Nate Lawson, a cryptographer who is principal of security consultancy Root Labs, said he doubted the proposed changes would be widely adopted.

“People who care about storage requirements are already doing this [truncation], so it's not really anything new,” he explained. “At this stage in the game, I don't think anyone is going to be using these particular truncated forms because why implement this latest tweak of the old standard when the new one is going to be out soon?” ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.