3
votes
1answer
68 views

Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? I am trying to find them in the original Keccak documentation but can't find them. Is it some special mode of Keccak referenced in the documentation? ...
5
votes
1answer
176 views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
16
votes
1answer
395 views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where ...
3
votes
1answer
167 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
1answer
205 views

What are the key differences between the draft SHA-3 standard and the Keccak submission?

I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014). Previously it ...
4
votes
1answer
258 views

Keccak padding implementation, and bit ordering

I am trying to implement Keccak in Java for my school work. And I am getting stuck in two places: On the summary page the padding is shown as P = M || 0x01 || 0x00 || … || 0x00 P = P xor ...
4
votes
1answer
91 views

Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?

I'm trying to learn about sponge function for creating hash functions and generic attacks on it. I'm looking for the collision finding attack scenario which leads to $O(\min(2^{-n/2} , 2^{-c/2}))$ ...
13
votes
3answers
779 views

Are NIST's changes to Keccak/SHA-3 problematic?

NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as ...
8
votes
1answer
500 views

Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
9
votes
1answer
217 views

What is the origin of the word “Keccak”?

Where does the word or acronym Keccak come from? Guido Bertoni, Joan Daemen, Michael Peeters, and Gilles Van Assche. Keccak sponge function family main document. Submission to NIST (updated), 2009. ...
5
votes
1answer
263 views

What criteria make the theta step of Keccak's round function reversible?

From what I've been reading, Keccak's round function is reversible. That's pretty obvious for the $\rho$, $\pi$ and $\iota$ transforms. For $\chi$ to be reversible, $x$'s range has to be odd — but ...
15
votes
1answer
490 views

What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → ...
6
votes
1answer
306 views

Any point in waiting for the SHA-3 standard?

The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter? That is, can we just assume it's going to be as specified by the submitters ...
8
votes
2answers
1k views

Why are the constants so simple in Keccak?

Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF) The initial values of the state in Keccak is ...
14
votes
4answers
1k views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...