gchq / gchq/CyberChef

Bug report: [SHA2] Default 'Rounds' Value for SHA-2 Family Does Not Reflect Actual Cryptographic Standard

Open
#2,576 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

The configuration panel for operations in the SHA-2 family (specifically SHA224, SHA256, SHA384, SHA512, SHA512/224, and SHA512/256) presents a user-configurable "Rounds" parameter. The default value for this parameter is displayed as 160 for algorithms in the SHA-512 family.

While the implementation functions correctly, this default displayed value is misleading and represents a deviation from the established cryptographic standard. The actual number of computational rounds performed for SHA-512 is 80, as defined in the official specification (FIPS PUB 180-4).

This discrepancy originates from the underlying crypto-api library. The library's implementation uses a loop with a step size of 2 when iterating through the rounds. This means the loop counter increments by 2 per iteration, resulting in 80 actual computational rounds being performed, despite the loop variable ranging up to 160. The number 160 is exposed to the CyberChef UI as the Rounds parameter, which is misleading.

[crypto-api:sha512.mjs#L182](https://github.com/nf404/crypto-api/blob/d39f6cede07dcf55cbf884eb4e0fa27f6d1466eb/src/hasher/sha512.mjs#L182)

Contributor guide

Open the contributing guide

Research direction

Start with the SHA-2 configuration panel and inspect the linked crypto-api file src/hasher/sha512.mjs at line 182, where the loop exposes the 160 value. Trace how that value becomes the CyberChef Rounds parameter for SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Done means the displayed default reflects the algorithms’ actual computational rounds, with SHA-512-family operations showing 80 rather than 160.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.