Questions tagged [sha-3]

SHA-3, also known as Keccak, is a cryptographic hash function standardized by NIST as a new alternative to the SHA-2 hash function family.

Filter by
Sorted by
Tagged with
14 votes
5 answers
9k views

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

My friend in the software industry came to me with one of his "dumb boss" war stories. This particular time, his (non-technical but eager to learn) manager came to him and told him to, in ...
squinged's user avatar
  • 143
2 votes
1 answer
153 views

SHAKE128 range calculation for MonteCarlo messages

For SHAKE128 NIST has provided test vectors for Monte Carlo: ...
Umadevi Palathur's user avatar
3 votes
0 answers
81 views

Preimage resistance of sponge-based hashes and XOFs

In the sponge construction for hash functions, including SHA3 and SHAKE, its used a permutation $$f:\{0,1\}^r\times\{0,1\}^c\to\{0,1\}^r\times\{0,1\}^c\\ \;\quad(R,C)\quad\quad\mapsto\quad\;(R',C')$$ ...
fgrieu - mod election time's user avatar
1 vote
2 answers
221 views

SHA3 224 bit oriented mode and padding

I am looking for an example of handling bit messages in SHA-3. I have looked at the example for 5-bit here but when I give complete padded msg ...
Umadevi Palathur's user avatar
0 votes
0 answers
78 views

SHA3 bit oriented mode [duplicate]

I have implemented the following code for SHA3-224 which uses "shortmessage" in bit oriented mode, the message length is 47 bits and I am not able to get correct message digest which is ...
Umadevi Palathur's user avatar
0 votes
1 answer
128 views

Set with probability of SHA-3 collisions lower than for a random oracle?

Can we define one finite set of input strings for a SHA-3 hash (or SHAKE XOF) function so that the collision probability is arguably lower than for a random oracle, with a definition of the set making ...
fgrieu - mod election time's user avatar
1 vote
1 answer
58 views

Is KangarooTwelve hash function suitable for generating very large key material as Shake-256 is?

If I take a large truly random portion of data, I know that I can generate a 2048-bits key with it (assuming the random data has more entropy than the key). I read in this forum that Shake-256 has ...
alpominth's user avatar
  • 393
3 votes
1 answer
403 views

SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS

By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256 i.e. SHAKE256_256(M) = SHAKE256(M,256) What is the motivation of choosing SHAKE256_256 ...
user's user avatar
  • 173
2 votes
1 answer
139 views

SHAKE256 XOF: Absorb incrementally vs all at once

I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher. I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
Rui 's user avatar
  • 31
1 vote
1 answer
1k views

What does the 256 in SHA3-256 and SHAKE256 refer to?

I am simply wondering what the bit-length in the algorithm variant in the table below refers to? For the hash functions I assume that this refers to the ouput length in bits. For instance for SHA3-256 ...
Rory's user avatar
  • 335
1 vote
1 answer
100 views

Does information about known input&output for SHA3-256 help to find KECCAK-256 input for the same output?

I received two distinct outcomes from a single input using SHA3-256 and KECCAK-256: input --> sha3-256 --> output1 input --> keccak-256 --> output2 ...
Ilya's user avatar
  • 11
0 votes
1 answer
44 views

Outside of use in microchips and FPGAs does SHA-3 have a lookup table? [closed]

Is SHA-3 normally used with a LUT or hash table?
Unequaled Density's user avatar
0 votes
2 answers
307 views

Is sha3 a one-way funtion

If i store sensitive stuff (e.g passwords, salted passwords, Internet protacel adresss(so i know its not tamperd with), private keys(the keys are using a portion of the key on multiple disks in ...
Downvoter's user avatar
2 votes
1 answer
116 views

How do the c-bits (capacity bits) make the sponge construction better?

I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
questions change the world's user avatar
3 votes
1 answer
150 views

Is SHAKE hash function seekable when using it as a stream cipher?

I searched a lot for this information in search engines as well as taking a look in the SHAKE reference implementation. If I decide to use SHAKE as a stream cipher, can I access a specific part of the ...
phantomcraft's user avatar
4 votes
1 answer
447 views

SHA2 vs SHA3 popularity

Does anybody know or can point me to a source about SHA2 vs SHA3 usage statistics. SHA3 is newer and is claimed to be more secure but ... is it more widely used in real life deployments?
user104734's user avatar
3 votes
2 answers
511 views

Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?

Context I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
Ben Zelnick's user avatar
1 vote
1 answer
138 views

Should the cSHAKE customization string ever be attacker-controlled?

On first glance, the optional customization string for cSHAKE resembles the optional salt input to HKDF-Extract. Indeed, the Noise Protocol Framework initially uses a protocol identifier string as its ...
Neil Madden's user avatar
0 votes
1 answer
379 views

Keccak Capacity bits Parameter

I am learning Keccak Hash Algorithm and I am a little bit confused about the Capacity bits parameter. I am trying to understand how we can set the capacity parameters while implementing Keccak in ...
Crypto_Learner 's user avatar
2 votes
1 answer
288 views

Create a control hash string from different sources, is there a difference, advantage or disadvantage in comparison when using this ways?

I wanna create from several inputs/sources should be formed into one hash value for controlling of different thinks later. Example: String + File String + String File + File String + File + String ...
Z0OM's user avatar
  • 155
3 votes
1 answer
480 views

What's the problem with ECDSA and SHA-3?

To quote Ilari on the CFRG mailing list: e.g. the vile mess that is ECDSA with SHA-3 I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
Elias's user avatar
  • 4,903
1 vote
0 answers
193 views

Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?

I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness: ...
The amateur programmer's user avatar
0 votes
1 answer
91 views

Is this possible?

So I've been working on a project that aims to allow online distribution of one-time-pads securely. I understand that a pad cannot be reused and must be truly random, and that if it is compromised, ...
awholegnuworld's user avatar
-3 votes
1 answer
308 views

What's the deal with Belgian cryptographers? [closed]

Some of the most widely-used/advanced cryptography products these days - AES and SHA3 - were invented by Belgians. It seems that fact is hardly a coincidence. Since I'm a complete layman, I can make ...
longtry's user avatar
  • 113
0 votes
1 answer
840 views

Are RSA-SHA256 signatures prone to length extension attacks?

I need to sign a message using a private key and verify the message with a public key, while making sure the message hasn’t been tampered. I know that SHA-256 itself is prone to length-extension ...
vdavid's user avatar
  • 103
2 votes
2 answers
398 views

Why is the output size exactly half the capacity for sha-3?

For the SHA-3 family of hash functions, the output size $d$ is always chosen as $d=c/2$, i.e. exactly half the capcity. What is the rational for this? Naively, I think that $d=c$ would make more sense ...
Simon's user avatar
  • 123
1 vote
2 answers
87 views

If secret S is not known to an attacker, while constant K and SHA3(K + SHA3(S)) are known to an attacker, is S discoverable?

I'm trying to understand how secure S is from an attacker. Let's say in an instance where they have enormous hashing power available to them, as would be the case where they own cryptocurrency mining ...
Derek's user avatar
  • 111
1 vote
1 answer
70 views

What input bits are revealed when revealing the first 256 bits of the output Keccak-f permutation?

Given the Keccak-f[1600] permutation I am interested in the following property: What bits in the output are influenced by what bits of the input? That is, if I change for example say the second bit of ...
cryptobeginner's user avatar
0 votes
1 answer
366 views

Selecting parameters for PBKDF2 using SHA3

I'm using PBKDF2 to generate an ED448 signing key, and I'm trying to figure out the optimal salt size for SHA-3. I recall reading a recommendation to use a salt size equal to the PRF's internal-state ...
user98919's user avatar
2 votes
1 answer
314 views

How can I understand the math behind crypto, especially that used in blockchains / distributed ledgers?

A bit of a background about me; Computer Engineer but during my studies I didn't dive too deep into the maths, especially the crypto maths that is used to make the blockchain and cryptography work. I'...
Muhammad Yasir's user avatar
2 votes
0 answers
188 views

Clarification about the iota function of SHA-3

I am trying to implement SHA-3 using this document and have a question about the iota step. This step consists in a single XOR between the central (0, 0) lane of the state (illustration of the state p....
Katoptriss's user avatar
0 votes
0 answers
45 views

What is the difference between HMAC-SHA3-512 and KMAC? [duplicate]

Reading through the wikipedia entry for HMAC I see that SHA-3 can be used with the HMAC algorithm to give HMAC-SHA3-512. I also know that there is KMAC, which from ...
dade's user avatar
  • 133
4 votes
1 answer
1k views

Is KMAC just SHA-3-256(KEY || message)

According to keccak strengths you have: Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be ...
Finlay Weber's user avatar
1 vote
0 answers
87 views

Exact security requirements for extendable output functions (XOF)?

In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as: An extendable-output function (XOF) is a ...
cryptobeginner's user avatar
10 votes
3 answers
7k views

Why is SHA3 more secure than SHA2?

Why are SHA3 algorithms considered more secure than their SHA2 counterparts? Surely in part, it is due to their resistance to length extension attacks. But specifically, when considering collision ...
Arturo Roman's user avatar
0 votes
2 answers
105 views

Using hash of data as proof of integrity and preventing collision

Rather than storing user data when interacting with an app, I am storing the SHA3-256 of the data. This is because data storage in this particular environment is very limited. The data can be several ...
Jaime's user avatar
  • 103
-2 votes
2 answers
151 views

What are the security flaws of SHA? [closed]

I have been researching SHA algorithms extensively, specifically SHA1, SHA2-256, SHA2-512, SHA3-256, and SHA3-512, and have found many instances of successful collision attacks as well as methods. In ...
Arturo Roman's user avatar
1 vote
2 answers
168 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
Zola Gonano's user avatar
1 vote
0 answers
292 views

Lightweight encrypting for BLE advertising packets

I'm new to encryption and this is my first time working with it. I'm currently working on a home project which consists of the equipment in my garage to be attached with a BLE device which sends ...
nbafanatic's user avatar
2 votes
1 answer
191 views

Does anyone know why NISTs SHA3 256 output Hash for the 1600 bit file is different to other SHA3 256 output hashes?

I have been trying to implement my own SHA3 256 function in python to try and learn and understand how it works. I have been comparing my hashes with an online sha3 tool found here https://emn178....
Ishwar Lyall's user avatar
0 votes
0 answers
65 views

Using a bit sequence of zeros followed by one byte in Keccak

For what purpose it is not right to use a bit sequence of 2000+ zeros followed by one byte in Keccak? Is there a possible application of such input for Keccak? If yes, after which transformation?
Emma711's user avatar
9 votes
1 answer
2k views

Outlook of trustworthiness of SHA-2

On the Wikipedia page of SHA-2, the following is written: Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512, and ...
matthias_buehlmann's user avatar
0 votes
1 answer
142 views

Different inputs but able to generate consistent outputs across different SHA engines

Say I'm feeding in few thousand bits data (INPUT AAAA) into both SHA256 & SHA3 256 engines at the same time. (Both engines using different hashing architecture) and hence it will generate ...
Pi-Turn's user avatar
  • 83
2 votes
1 answer
81 views

Can you use a dynamic key and data size for KMAC?

I've asked before if some kind of canonical encoding should be used on the input parameters of SHA-3 before it could be used as replacement for HMAC. However, if I read the current NIST specifications ...
Maarten Bodewes - mod election's user avatar
3 votes
1 answer
205 views

Can a SHA3 engine be used to construct a Keccak implementation?

I am working on a cSHAKE-128 & cSHAKE-256 implementation that takes advantage of a number of hardware accelerators I have at my disposal, specifically for SHA-3 256/384/512 and SHAKE 128/256. ...
ismarlowe's user avatar
3 votes
1 answer
259 views

SHA3 hexadecimal paddig odd length string

Section B2 of FIPS-202 specification describes the Hexadecimal Form of Padding Bits which is basically the translation of the bit padding 0110*1. However at the beginning they suppose that the message ...
IAmUser's user avatar
  • 33
1 vote
1 answer
109 views

SHA3-512 similar message digest

How is it possible to find a similar message-digest for SHA3-512 for the first 80 bits or so? There was a Q/A on this site where the answer stated that 80 bits that $2^{42}$ computations are required. ...
Tejas Bhuwania's user avatar
-1 votes
1 answer
191 views

Are there any crypto hash implementation beyond 512 bits of output?

My question is this: Are there any crypto hash implementations beyond 512 bits of output? Could you give me the link? Thank you so much for your time. Greetings.
Jorge Alberto Medina Rosas's user avatar
-5 votes
2 answers
276 views

Are the common hash algorithms already dead? [closed]

I have one honestly question: How can we are so confident with the use of the common hash algorithms (nowadays there are so many pages with cracking tools: crackstation, gpuhash, etc) ? Are we lost ...
Jorge Alberto Medina Rosas's user avatar
1 vote
3 answers
297 views

Using sha3 as a deterministic source of psuedo-random bytes for xor encryption

The following code generates a deterministic stream of pseudo-random bytes, using SHA3. ...
fadedbee's user avatar
  • 916