Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014).

Previously it was discussed here that NIST would be changing stuff compared to the submission, which was seen as problematic (mainly from a reputation point of view).

  1. Did these discussed changes make it into the draft standard?
  2. What else are the changes in the draft standard compared to the submission?
  3. Are any of these relevant from a security point of view?
share|improve this question
  1. No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed.

  2. The padding change is the only difference, this allows future tree hashing modes as well as the current SHAKE outputs to generate different digests given the same security parameters and message inputs. Up to 4 additional bits are added, which keeps the full padding inside a byte boundary, making implementations with octet only input able to switch to SHA-3 from Keccak with change to only a single line of code.

  3. The padding change has no negative impact on the security of SHA-3.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.