31

SHA384 is a truncated version of SHA512. But why would anyone use it? And corollary: if SHA384 is just as good as SHA512, is there any rationale in using the 512 bit version?

I am planning to use one of the algorithms to verify file integrity, so I am mainly interested in collision security.

I would be happy to hear how anyone uses the SHA2 digests in practice and why would you chose one version over the other.

1
  • 3
    SHA224 is a truncated version of SHA256. Wikipedia lists SHA224 as "to match the key length of two-key Triple DES". I can't find a statement for SHA384, though I suspect something similar.
    – Mysticial
    Apr 8, 2012 at 8:48

5 Answers 5

31

SHA512, SHA256, SHA1, and MD5 are vulnerable to a length extension attack. SHA224 and SHA384 are not since reduced output to internal state, SHA3 is also not vulnerable. Having that in mind, SHA512 is a good cryptographic collision-resistant hash function.

2
  • 3
    SHA512 is also vulernable to length extension attack. From SHA-2 only SHA224 and SHA834 are not.
    – Marqin
    Apr 7, 2017 at 11:05
  • Trying to decide which SHA function to use for a new feature and this was very helpful, thank you
    – mmitchell
    Sep 30, 2021 at 22:18
28

For practical purposes and the foreseeable future, both SHA384 and SHA512 are good enough for almost any imaginable collision-resistance application. Generally, the primary determining factor of what hash you would use, once we're above 256 bits and collision resistance is infinite for practical purposes, is just how many bits of output you need. For example, if you need the hash to generate both a 256-bit HMAC key and a 128-bit encryption key, SHA384 is a natural choice. If you need as much output as possible for the computational cost, say for output of a PRNG or as random padding, then SHA512 makes sense.

11

Certificates signed with SHA512 don't appear to work with TLS 1.2 on Windows (see here)

Therefore, I will be recreating my certificate chain using SHA-384 (or I suppose I could use SHA-256).

While thankfully, I have not released any certs yet, the thread in the linked page does propose a workaround/fix for those who are stuck with SHA-512.

HTH!

11

SHA512 is vulnerable to length extension attack and SHA384 is not. Source

1

Only reason I could think of using SHA-384 vs. SHA-512 is due to Digest need for signing. For example, if you are adopting ECDSA-384 signing, it requires 384 hash digest, not 512 bit. Ideally, you could throw out any 128-bit from 512-bit. But receiving end need know which 128-bit you throw out. So only difference between SHA384 and SHA512 is to define which 128-bit you need throw out.

1
  • 1
    “SHA512 is vulernable to length extension attack and SHA384 is not. [source]” This is not fair comment. This vulnerable is created due to use SHA2 improperly. If you want to use SHA2 for MAC function, just follow HMAC standard. All SHA2 algorithms, SHA2-224, 256, 384, and 512 are ok if you follow HMAC.
    – Ting Lu
    Jan 9, 2019 at 17:25

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.