Re: [TLS] Entropy of SHA-2 and the P_SHA256-based PRF

[Martin Rex <[e-mail]>]

Brian Smith wrote:
> 
> Here is an interesting paper regarding the entropy of the output of SHA-2
> with a special mention of the TLS 1.2 PRF. If I am understanding correctly,
> SHA-2 reduces the entropy of a random input by half the first time it is
> applied, and the entropy slowly decreases every time it is applied
> thereafter. 
> 
> "For illustration we can say that the entropy of E(PRF[1]) = 253.463, but
> the entropy of E(PRF[60]) = 250.00."
> 
> "Practical consequences of the aberration of narrow-pipe hash designs from
> ideal random functions"
> 
> Danilo Gligoroski and Vlastimil Klima
> 
> http://eprint.iacr.org/2010/384


A few observations.

Section 4.4 of this paper talks about PBKDF1
("Password based key derivation function 1" from PKCS#5),
and PBKDF1 was defined for MD2 and MD5 by PKCS#5 v1.5 and expanded
to SHA-1 by PKCS#11.

I assume that SHA-256 would more likely be used with PBKDF2
(which may share the relevant properties with PBKDF1
 with respect to the described effect of slow entropy depletion).

I assume that the effect of increased collisions for highly iterated
hashes similarly affect SHA-1 and MD5 password hashes.


I'm wondering whether an approach like this would compensate
the effect:

  Hash( user | pw | iteratedHash( Hash(pw | user | salt) ) )


-Martin