> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/09.-sha-2.md).

# 09. SHA-2

### 1. What SHA-2 Is

SHA-2 is a **family of cryptographic hash functions** designed to replace SHA-1.

Common variants:

* **SHA-256** → 256-bit output (64 hex characters)
* **SHA-512** → 512-bit output (128 hex characters)

Example (SHA-256):

```
Input  → hello  
SHA-256 → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
```

***

### 2. Core Properties

* One-way function (not reversible)
* Deterministic
* Fixed-length output
* Strong avalanche effect
* No practical collision attacks

***

### 3. SHA-2 vs SHA-1

| Feature     | SHA-1      | SHA-2          |
| ----------- | ---------- | -------------- |
| Output size | 160-bit    | 256 / 512-bit  |
| Security    | Broken     | Secure         |
| Collisions  | Yes        | None practical |
| Usage       | Deprecated | Standard       |

***

### 4. How SHA-2 Works (Simple Structure)

SHA-2 also uses **Merkle–Damgård construction**, like SHA-1.

***

#### Step 1: Padding

Message is padded to fit blocks.

* SHA-256 → 512-bit blocks
* SHA-512 → 1024-bit blocks

***

#### Step 2: Initialize variables

For SHA-256:

```
8 registers: A, B, C, D, E, F, G, H
```

***

#### Step 3: Message schedule

Input block is expanded into multiple words.

***

#### Step 4: Compression rounds

* SHA-256 → 64 rounds
* SHA-512 → 80 rounds

Each round uses:

* bitwise operations
* rotations
* modular additions

***

#### Step 5: Output

Final state → combined into final hash.

***

### 5. Why SHA-2 is Secure

* No known practical collision attacks
* Strong internal design
* Large output space (hard to brute force)

***

### 6. Important Weakness (Conceptual)

#### Length Extension Attack

Like SHA-1, SHA-2 is vulnerable to:

```
SHA256(secret || message)
```

If attacker knows hash, they can compute:

```
SHA256(secret || message || extra)
```

Without knowing the secret.

***

#### Fix in real systems:

Use:

* HMAC (Hash-based Message Authentication Code)

***

### 7. Practical Usage

SHA-2 is widely used in:

* HTTPS / TLS
* Digital signatures
* Blockchain (Bitcoin uses SHA-256)
* File integrity verification
* APIs and authentication systems

***

### 8. Tools and Commands

#### Linux

```bash
echo -n "hello" | sha256sum
```

***

#### Python

```python
import hashlib

print(hashlib.sha256("hello".encode()).hexdigest())
```

***

### 9. Can SHA-2 be “cracked”?

#### Short answer:

No (if used properly)

***

#### Only possible if:

* Input is small
* Weak password used
* No salt (in password hashing)
* Predictable data

***

#### Hashcat example:

```bash
hashcat -m 1400 hash.txt rockyou.txt
```

***

### 10. CTF Mindset

When you see SHA-256:

#### DO NOT:

* try brute force blindly (too slow)

***

#### Instead check:

* Is input small?
* Is it a known word?
* Is there a pattern?
* Is it used incorrectly (e.g., length extension)?
* Is it part of a larger system?

***

### 11. Real-World Status

SHA-2 is:

* Secure
* Widely trusted
* Industry standard

Used everywhere modern cryptography is required.

***

### 12. SHA-256 vs SHA-512

| Feature  | SHA-256          | SHA-512          |
| -------- | ---------------- | ---------------- |
| Output   | 256-bit          | 512-bit          |
| Speed    | Faster on 32-bit | Faster on 64-bit |
| Security | Very strong      | Even stronger    |

***

### 13. Final Summary

SHA-2 is:

* Secure modern hash function
* Not reversible
* Not practically breakable
* Still structurally similar to SHA-1 (with improvements)

***

#### Core Idea

You don’t break SHA-2 directly.

You break:

* weak inputs
* bad implementations
* logic flaws


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/09.-sha-2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.