blocks|key|2431061|text|在SHA2的内部分组密码中，根据模式有64或80轮，SHA256有64圈，SHA512有80圈。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2431062|📷|atomic|offset|length|2431063|为什么在这种情况下我们需要T1和T2？|blockquote|2431064|除了T_1和T_2，一切都是线性的。在图片中，它们是蓝色和红色的单词加法(\color{red}{\boxplus})。在密码学中，仅仅是线性并不是一个好主意。它易于攻击，因为它可以建立线性方程组和求解高斯消除。非线性是必要的，但不是充分的。它使用多轮混淆与扩散范式，其中分组密码的密钥是消息。|style|CODE|2431065|T1和T2代表什么值？|2431066|值根据输入变化，但函数定义是固定的。|2431067|但是为什么要经历这么多轮班和其他操作呢？|2431068|您可以将移位操作视为设计的扩散部分，以便在较小的回合中影响每个具有多个关键位和多个输入位的输出位。|2431069|当然，上述所有这些都不能声称SHA256是安全的。它的设计是安全的与以前的知识，哈希设计。然而，SHA2在理论上并没有中断，甚至比经典的泛型攻击还要少一点。|2431070|具有\mathcal{O}(2%5E{256})的图像前攻击|unordered-list-item|2431071|第二次图像前攻击\mathcal{O}(2%5E{256})|2431072|碰撞攻击\mathcal{O}(2%5E{128})由于一般的生日攻击。|2431073|最著名的攻击是在减缩子弹类预图像攻击上进行的64轮攻击中的42轮，2%5E{248.4}也很复杂。|2431074|即使它在理论上被打破了，它也可能没有实际效果。例如，在实际中不能使用2%5E{200}进行全面的图像前攻击.|2431075|NISTSHA-1的先前哈希被破坏，第一个伪造被生成，见对SHA-1的攻击列表。对于SHA-2，时间将显示。就像攻击总是变得更好，永远不会变得更糟。说的|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://i.stack.imgur.com/6C2g5.jpg|imageAlt|1|INLINETEX|teX|T_1|2|T_2|3|\color{red}{\boxplus}|4|LINK|MUTABLE|url|https://en.wikipedia.org/wiki/Confusion_and_diffusion|5|\mathcal{O}(2%5E{256})|6|\mathcal{O}(2%5E{256})|7|\mathcal{O}(2%5E{128})|8|https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation|9|http://eprint.iacr.org/2010/016.pdf|10|2%5E{248.4}|11|2%5E{200}|12|https://crypto.stackexchange.com/q/76879/18298|13|https://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html^0|0|0|1|0|0|0|2|3|6|3|11|L|2|3|1|6|3|2|11|L|3|3I|7|4|0|0|0|0|0|0|2|K|2|K|5|0|8|K|8|K|6|0|4|K|4|K|7|0|X|9|8|4|8|D|5|9|X|9|A|0|Y|7|Y|7|B|0|R|C|C|1K|I|D^^$0|@$1|2|3|4|5|6|7|2D|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|2E|8|@]|9|@$E|2F|F|2G|1|2H]]|A|$]]|$1|G|3|H|5|I|7|2I|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|2J|8|@$E|2K|F|2L|L|M]|$E|2M|F|2N|L|M]|$E|2O|F|2P|L|M]]|9|@$E|2Q|F|2R|1|2S]|$E|2T|F|2U|1|2V]|$E|2W|F|2X|1|2Y]|$E|2Z|F|30|1|31]]|A|$]]|$1|N|3|O|5|I|7|32|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|33|8|@]|9|@]|A|$]]|$1|R|3|S|5|I|7|34|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|35|8|@]|9|@]|A|$]]|$1|V|3|W|5|6|7|36|8|@]|9|@]|A|$]]|$1|X|3|Y|5|Z|7|37|8|@$E|38|F|39|L|M]]|9|@$E|3A|F|3B|1|3C]]|A|$]]|$1|10|3|11|5|Z|7|3D|8|@$E|3E|F|3F|L|M]]|9|@$E|3G|F|3H|1|3I]]|A|$]]|$1|12|3|13|5|Z|7|3J|8|@$E|3K|F|3L|L|M]]|9|@$E|3M|F|3N|1|3O]]|A|$]]|$1|14|3|15|5|6|7|3P|8|@$E|3Q|F|3R|L|M]]|9|@$E|3S|F|3T|1|3U]|$E|3V|F|3W|1|3X]|$E|3Y|F|3Z|1|40]]|A|$]]|$1|16|3|17|5|6|7|41|8|@$E|42|F|43|L|M]]|9|@$E|44|F|45|1|46]]|A|$]]|$1|18|3|19|5|6|7|47|8|@]|9|@$E|48|F|49|1|4A]|$E|4B|F|4C|1|4D]]|A|$]]]|1A|$1B|$5|1C|1D|1E|A|$1F|1G|1H|-4]]|1I|$5|1J|1D|1E|A|$1K|1L]]|1M|$5|1J|1D|1E|A|$1K|1N]]|1O|$5|1J|1D|1E|A|$1K|1P]]|1Q|$5|1R|1D|1S|A|$1T|1U]]|1V|$5|1J|1D|1E|A|$1K|1W]]|1X|$5|1J|1D|1E|A|$1K|1Y]]|1Z|$5|1J|1D|1E|A|$1K|20]]|21|$5|1R|1D|1S|A|$1T|22]]|23|$5|1R|1D|1S|A|$1T|24]]|25|$5|1J|1D|1E|A|$1K|26]]|27|$5|1J|1D|1E|A|$1K|28]]|29|$5|1R|1D|1S|A|$1T|2A]]|2B|$5|1R|1D|1S|A|$1T|2C]]]]

It is in the part of the internal block cipher of SHA2 that has 64 or 80 rounds depending on the mode, SHA256 has 64, SHA512 has 80 rounds.

<a href="https://i.stack.imgur.com/6C2g5.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6C2g5.jpg" alt="the picture of Wikipedia SHA2 page"></a>

<blockquote>
 Why do we need T1 and T2 in this case?
</blockquote>

Except the $T_1$ and $T_2$, everything is linear. In the picture, they are the blue and red word additions ($\color{red}{\boxplus}$). Being only linear is not a good idea in Cryptography. It is easy to attack since one can setup linear equations and solve by Gaussian Elimination. Nonlinearity is necessary but not sufficient. It uses the <a href="https://en.wikipedia.org/wiki/Confusion_and_diffusion" rel="nofollow noreferrer">confusion and diffusion paradigm</a> with many rounds where the key of the block cipher is the message.

<blockquote>
 What do the values T1 and T2 represent?
</blockquote>

Values changes according to inputs but the function definitions are fixed.

<blockquote>
 But why go through so many shifts and other operations?
</blockquote>

You can consider the shift operations as the diffusion part of the design, in order to affect each output bits with many key bits and many input bits in lesser rounds.

Of course, all of these above cannot claim that SHA256 is secure. It is designed to be secure with the previous knowledge about hash designs. Yet, SHA2 is not broken even theoretically i.e. even one bit less than the classic generic attacks

<ul>
<li>pre-image attack that has $\mathcal{O}(2^{256})$</li>
<li>second pre-image attack $\mathcal{O}(2^{256})$</li>
<li>collision attack $\mathcal{O}(2^{128})$ due to the generic birthday attack.</li>
</ul>

Best known attacks are on the <a href="https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation" rel="nofollow noreferrer" title="Wikipedia -&gt; SHA-2 -&gt; Cryptanalysis and validation">reduced rounds</a> like <a href="http://eprint.iacr.org/2010/016.pdf" rel="nofollow noreferrer" title="ian Guo; San Ling; Christian Rechberger &amp; Huaxiong Wang (2010). Advanced meet-in-the-middle preimage attacks: First results on full Tiger, and improved results on MD4 and SHA-2 (PDF). Advances in Cryptology – ASIACRYPT 2010. Lecture Notes in Computer Science. 6477. Springer Berlin Heidelberg. pp. 56–75.">preimage attack</a> for 42 of 64 rounds with a $2^{248.4}$ complexity. 

Even it is theoretically broken, it might not have a practical effect. For example, a full round pre-image attack with $2^{200}$ cannot be used in practice.

The previous hash of NIST SHA-1 is broken and the first forge is generated, <a href="https://crypto.stackexchange.com/q/76879/18298">see list of attacks on SHA-1</a>. For SHA-2, the time will show. As said <a href="https://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html" rel="nofollow noreferrer">Attacks always get better; they never get worse.</a>

I'm reading this paper: <a href="https://csrc.nist.gov/csrc/media/publications/fips/180/4/final/documents/fips180-4-draft-aug2014.pdf" rel="nofollow noreferrer">fips180-4-draft-aug2014</a>

I'm on page 23 where they have two values for SHA-256: T1 and T2. While I understand the operations done, I don't understand the bigger picture. Why do we need T1 and T2 in this case? What do the values T1 and T2 represent?

The paper defines it as "T Temporary w-bit word used in the hash computation." But why go through so many shifts and other operations?

Problem understanding SHA-256

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我在看这篇论文：F 180-4-草案-2014年8月我在第23页上，他们有两个SHA-256的值: T1和T2。虽然我了解所做的操作，但我不了解更大的情况。为什么在这种情况下我们需要T1和T2？T1和T2代表什么值？本文将其定义为“在散列计算中使用的T临时w位字”.但是为什么要经历这么多轮班和其他操作呢？

问SHA-256问题理解
EN

回答 1

Cryptography用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问SHA-256问题理解EN