I'm learning more about the Merkle–Damgård construction, including its "alternatives".

I learned about the fast wide pipe construction and the narrow pipe construction, explained here. However, I can't find any images showing the process of the narrow pipe scheme in detail (presuming it's not the same as the FWP construction).

What is the difference between these two constructions? And is there one construction proven to deliver better results than the other?


1 Answer 1


Of an iterated hash function $$H(m_0 \mathbin\Vert m_1 \mathbin\Vert \cdots \mathbin\Vert m_{n-1}) = g(f(\cdots f(f(\mathit{IV}, m_0), m_1)\cdots, m_{n-1})),$$ for functions $f\colon \{0,1\}^s \times \{0,1\}^k \to \{0,1\}^s$ and $g\colon \{0,1\}^s \to \{0,1\}^h$, narrow pipe, as introduced by Stefan Lucks, just means that the intermediate state is no larger, or not much larger, than the final output: $s = h$. Wide pipe means $s \gg h$.

In SHA-256, the intermediate state has $s = 256$ bits just like the output; thus SHA-256 is a narrow-pipe iterated hash function. In SHA-512/256, the intermediate state has $s = 512$ bits and the output has $h = 256$ bits; thus SHA-512/256 is a wide-pipe iterated hash function. In SHA3-256, the intermediate state has $s = 1600$ bits while the output has $h = 256$ bits; thus SHA3-256 is also wide-pipe.

In principle, SHAKE256-1600 would be considered narrow-pipe too, but such distinctions are not really used much these days; they don't illuminate relevant security properties very well. The attacks that Lucks hoped to thwart with wide-pipe constructions are usually addressed in other ways instead, and we aim for security targets rather than pipeyness.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.