1
$\begingroup$

I am simply wondering what the bit-length in the algorithm variant in the table below refers to? For the hash functions I assume that this refers to the ouput length in bits. For instance for SHA3-256 this means the hash will be of 256 bits in length. Is this correct?

But, then, what does the 256 mean for the XOF SHAKE256? The desired output length here is $d$.

I am hoping that there is something obvious I am not understanding and that this is an arbitrary question. However, I hope someone takes the time to answer me regardless.

The table below is from the SHA wikipage.

For the hash functions I SHA3-224

$\endgroup$

1 Answer 1

4
$\begingroup$

SHA3-256 this means the hash will be of 256 bits in length. Is this correct?

Yes, that is correct - exactly the same as SHA2-256 means that hash has an output of 256 bits.

But, then, what does the 256 mean for the XOF SHAKE256?

Obviously, that's not the output length (that's up to the application). Instead, it is the security level. That is, the amount of effort required to break the various standard security goals (preimage, second preimage and collision) is (barring some cryptanalytic advancement) about $2^{256}$ permutations (or inverse permutation) evaluations. This security level is essentially the capacity (state size minus the block size), divided by two.

One surprising thing about SHAKE is that collision attacks aren't that much easier than second preimage attacks; this is not true with SHA-2, where collision attacks appear to be much easier (if still infeasible). This happens because, for SHAKE, we can do an internal collision attack on the capacity bits, using the invertibility of the permutation for one of the directions; the effort required for this internal collision attack turns out to be about the same as a standard collision attack against the full hash function.

$\endgroup$
1
  • $\begingroup$ Thank you for taking the time to answer @poncho ! Interesting additional fact about SHAKE too. $\endgroup$
    – Rory
    May 2, 2023 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.