21

I'm running a service that is using SHA-256 on two sides of the application - one is a server-side PHP implementation and the other is a client-side iOS implementation. The result of using the algorithm on both sides is the same alphanumeric string, except for the fact that all letters are capitalized on iOS and lower case on PHP. The fact that they are identical alphanumeric strings leads me to believe that SHA-256 is case insensitive, but I can't find any documentation supporting my assumption. Can someone show me some documentation to confirm this?

paradox870
  • 2,152
  • 4
  • 20
  • 30
  • 1
    possible duplicate of [What is the output format of SHA256](http://stackoverflow.com/questions/6532606/what-is-the-output-format-of-sha256) –  Aug 09 '12 at 21:19

4 Answers4

31

If you are referring to a hexadecimal string output, then yes, that is case insensitive. It is a textual representation of binary data.

http://en.wikipedia.org/wiki/Hexadecimal

The algorithm itself is most definitely case-sensitive.

Brad
  • 159,648
  • 54
  • 349
  • 530
  • This is quite an old thread.. yet, I'm not sure this is a clear explanation. Any text is a binary data representation; however, different registries (lower-case or capital-case) have different binary codes underneath. T and t are different bits.. so is SHA256 case sensitive? then how come the output string is case insensitive? What do you mean in "The algorithm itself is most definitely case-sensitive."? – Giorgi Tsiklauri Dec 14 '20 at 18:35
  • 1
    @GiorgiTsiklauri SHA256 only works on on binary data, and it actually outputs binary data. Reading into the question a bit, it's clear that the person asking is seeing a hexadecimal representation of that binary hash. Yes, SHA256 is absolutely completely totally case sensitive. So is its output, as its output is binary. But if you transform that binary to hex, hex is case-insensitive. – Brad Dec 14 '20 at 18:45
6

No decent cryptographic hash function is case insensitive, because then it would be far easier to produce a collision. The output is a different matter. It's basically a large number (so casing does not apply), but for convenience it is given in base 16, i.e. using the letters a through f as additional digits. Hexadecimal notation is indeed case insensitive, or at least both upper- and lowercase variants are common and recognized. It doesn't matter and does not change what number is represented.

4

If the binary representation of the input is the same on both sides the binary representation of the hash value will be the same. Hex is case insensitive.

pizen
  • 464
  • 3
  • 4
1

All SHA series are binary algorithms they know nothing about case, so they can't be case insensitive.
You can simply test this on single machine with 2 outputs from one string with different cases and you can see that they provide different results.
In your case I think if every thing is ok, possibly iOS show capitalized string in the phone but internally pass you normal( lower case ) string

BigBoss
  • 6,904
  • 2
  • 23
  • 38