On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3):

eTCR: Find $M$ and then for a randomly chosen $r$, find $M’$ and $r’$ s.t. $H_r(M) = H_{r’}(M’), (r,M) ≠ (r’,M’)$ where $H_r$ is the randomized hash.

However, I never saw any subsequent references to the eTCR property for the SHA-3 candidates.

Does SHA-3 have an eTCR mode?

  • $\begingroup$ This property is also known as "enhanced Target Collision Resistance". $\endgroup$ Commented Nov 27, 2012 at 18:17
  • $\begingroup$ Do you ask if there is a "standardized" randomized hashing mode of Keccak? $\endgroup$ Commented Nov 27, 2012 at 18:27
  • $\begingroup$ Yes. ${}{}{}\:$ $\endgroup$
    – user991
    Commented Nov 27, 2012 at 19:14
  • 2
    $\begingroup$ Doesn't standard CR imply you get eTCR by simply concatenating the randomness and message and then applying the hash? $\endgroup$
    – David Cash
    Commented Nov 28, 2012 at 2:19
  • $\begingroup$ Yes. $\:$ Standard CR also implies you get eTCR by using zero bits of randomness $\hspace{1.5 in}$ and just applying the hash to the message. $\;\;$ $\endgroup$
    – user991
    Commented Nov 28, 2012 at 6:43

1 Answer 1


SHA-3 is conjectured to be collision-resistant, which is enough for $H(r \mathbin\| m)$ to be eTCR; if SHA-3 fell to a collision attack like MD5 and SHA-1 before it, it would nevertheless be surprising and remarkable and worthy of publication for SHA-3 to fall to a target collision attack as neither MD5 nor SHA-1 to my knowledge has, but one can only speculate about hypothetical developments past the failure of what is already only a conjecture.

The NIST-recommended ‘keyed hash’ function associated with SHA-3 is KMAC of NIST SP 800-185, of course. If you're still not comfortable with that, the NIST-recommended randomized hash for collision-resilient signatures is RMX of NIST SP 800-106, which you could use with SHA-3 out of an abundance of paranoia, but I have never heard of anyone bothering to do that.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.