Hash functions vs Stream Ciphers in terms of Speed

Question

We know that it's possible to create a hash using a stream cipher (for instance, RC4 or AES in Counter Mode). As stated here: "A Pseudo Random Generator (PRG) and a hash function are both Pseudo Random Functions (PRFs), but they have different security considerations". Whether or not it's advisable to do so, is there a correlation between the way of a hash function being created and its speed? For instance, are cryptographically secure hash functions (such as SHA-1) faster than a hash function created using a stream cipher, or the opposite? Is each case entirely different?

Take this paper as an example. In page 6 you'll see the protocol. As described, the protocol uses a PRG which takes as an input something of size k and produces something of size m. The authors say that they implemented the PRG using AES in Counter Mode. The reason for not using a hash function is because we want the output to vary and sometimes being really big (say 100.000) where when using a hash function the output is fixed (i.e. 160 for SHA-1). For the sake of argument, let's say that the size of the output is not a problem (we use something small like 160) and that we don't take security into consideration.

Which PRG would be faster? A stream cipher (like AES in Counter Mode) or a Hash Function like SHA-1?

Answer 1

Which PRG would be faster? A stream cipher (like AES in Counter Mode) or a Hash Function like SHA-1?

While it is correct to say that it depends on the function, the practical answer is that stream ciphers, including AES in CTR mode, are usually faster at generating output than hash functions. In particular SHA-1. Hashes are quite fast at consuming input, but not so fast at generating output.

For example, you can look at eBACS results on Skylake for hash functions and stream ciphers. You will see SHA-1 taking 454 cycles to generate a block of output for a short input (which is what you would use with e.g. the hash function in CTR mode), so 22.7 cycles per byte of output (SHA-1 is 20 bytes). In comparison, all but the slowest stream ciphers measured are much less than 3 cycles per byte for long messages. Even aes256estream is about twice the speed of SHA-1.

Answer 2

There is a lot of confusion in this question. Hash functions provide collision resistance. However, under a pretty reasonable assumption, they can be used to obtain a PRG or a PRF. Thus, hash functions and stream ciphers can be used to obtain a pseudorandom generator. This is true. (Although RC4 is broken and CANNOT be used for this purpose any more.)

Now, the question is: what is faster? A hash function, a stream cipher, a block cipher, and so on. The answer is very simple! It depends on the function in question and on the platform. If you have an AES-NI instruction set, then this is incredibly fast. It is also a very good option since its security is better studied than any stream cipher that hasn't yet been broken. Hash functions (like the SHA family) are actually pretty slow in comparison. Once Intel puts SHA-2 into hardware, then we'll have to see, but from what I understand it will be slower than AES. If you don't have AES-NI, then things like Salsa20 are a good option. However, my preference is always AES, and unless you really can't use it for some reason, that is always my recommendation.