Bug report: [SHA2] Default 'Rounds' Value for SHA-2 Family Does Not Reflect Actual Cryptographic Standard
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
The configuration panel for operations in the SHA-2 family (specifically SHA224, SHA256, SHA384, SHA512, SHA512/224, and SHA512/256) presents a user-configurable "Rounds" parameter. The default value for this parameter is displayed as 160 for algorithms in the SHA-512 family.
While the implementation functions correctly, this default displayed value is misleading and represents a deviation from the established cryptographic standard. The actual number of computational rounds performed for SHA-512 is 80, as defined in the official specification (FIPS PUB 180-4).
This discrepancy originates from the underlying crypto-api library. The library's implementation uses a loop with a step size of 2 when iterating through the rounds. This means the loop counter increments by 2 per iteration, resulting in 80 actual computational rounds being performed, despite the loop variable ranging up to 160. The number 160 is exposed to the CyberChef UI as the Rounds parameter, which is misleading.
[crypto-api:sha512.mjs#L182](https://github.com/nf404/crypto-api/blob/d39f6cede07dcf55cbf884eb4e0fa27f6d1466eb/src/hasher/sha512.mjs#L182)
Contributor guide
Research direction
Start with the SHA-2 configuration panel and inspect the linked crypto-api file src/hasher/sha512.mjs at line 182, where the loop exposes the 160 value. Trace how that value becomes the CyberChef Rounds parameter for SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Done means the displayed default reflects the algorithms’ actual computational rounds, with SHA-512-family operations showing 80 rather than 160.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100