Skip to content

Bug report: [SHA2] Default 'Rounds' Value for SHA-2 Family Does Not Reflect Actual Cryptographic Standard #2576

Description

@WXjzcccc

The configuration panel for operations in the SHA-2 family (specifically SHA224, SHA256, SHA384, SHA512, SHA512/224, and SHA512/256) presents a user-configurable "Rounds" parameter. The default value for this parameter is displayed as 160 for algorithms in the SHA-512 family.

While the implementation functions correctly, this default displayed value is misleading and represents a deviation from the established cryptographic standard. The actual number of computational rounds performed for SHA-512 is 80, as defined in the official specification (FIPS PUB 180-4).

This discrepancy originates from the underlying crypto-api library. The library's implementation uses a loop with a step size of 2 when iterating through the rounds. This means the loop counter increments by 2 per iteration, resulting in 80 actual computational rounds being performed, despite the loop variable ranging up to 160. The number 160 is exposed to the CyberChef UI as the Rounds parameter, which is misleading.

crypto-api:sha512.mjs#L182

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions