2
$\begingroup$

On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3):

eTCR: Find $M$ and then for a randomly chosen $r$, find $M’$ and $r’$ s.t. $H_r(M) = H_{r’}(M’), (r,M) ≠ (r’,M’)$ where $H_r$ is the randomized hash.

However, I never saw any subsequent references to the eTCR property for the SHA-3 candidates.

Does SHA-3 have an eTCR mode?

Improve this question
$\endgroup$
5
  • $\begingroup$ This property is also known as "enhanced Target Collision Resistance". $\endgroup$
    – Paŭlo Ebermann
    Nov 27, 2012 at 18:17
  • $\begingroup$ Do you ask if there is a "standardized" randomized hashing mode of Keccak? $\endgroup$
    – Paŭlo Ebermann
    Nov 27, 2012 at 18:27
  • $\begingroup$ Yes. ${}{}{}\:$ $\endgroup$
    – user991
    Nov 27, 2012 at 19:14
  • 2
    $\begingroup$ Doesn't standard CR imply you get eTCR by simply concatenating the randomness and message and then applying the hash? $\endgroup$
    – David Cash
    Nov 28, 2012 at 2:19
  • $\begingroup$ Yes. $\:$ Standard CR also implies you get eTCR by using zero bits of randomness $\hspace{1.5 in}$ and just applying the hash to the message. $\;\;$ $\endgroup$
    – user991
    Nov 28, 2012 at 6:43

1 Answer 1

Reset to default
1
$\begingroup$

SHA-3 is conjectured to be collision-resistant, which is enough for $H(r \mathbin\| m)$ to be eTCR; if SHA-3 fell to a collision attack like MD5 and SHA-1 before it, it would nevertheless be surprising and remarkable and worthy of publication for SHA-3 to fall to a target collision attack as neither MD5 nor SHA-1 to my knowledge has, but one can only speculate about hypothetical developments past the failure of what is already only a conjecture.

The NIST-recommended ‘keyed hash’ function associated with SHA-3 is KMAC of NIST SP 800-185, of course. If you're still not comfortable with that, the NIST-recommended randomized hash for collision-resilient signatures is RMX of NIST SP 800-106, which you could use with SHA-3 out of an abundance of paranoia, but I have never heard of anyone bothering to do that.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.