12
$\begingroup$

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these are not arbitrary lengths. How then is SHA3 a sponge function?

Is there a specific way to generate "arbitrary length" using bouncy castle implementation?

Here is my code:

     SHA3.DigestSHA3 digestSHA3 = new SHA3.DigestSHA3(320);
     byte[] digest = digestSHA3.digest(bip39Seed);

What am I missing?

My uneducated guess is that the standardized version of Keccak is different from the original one that was submitted to NIST. If this is the case, how can I get to the version that allows me to specify arbitrary lengths?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ Have you looked for SHAKE128 or SHAKE256, or have you studied how SHA3-224/256/384/512 work? These may be instructive. $\endgroup$
    – Squeamish Ossifrage
    Mar 11, 2018 at 19:35

2 Answers 2

Reset to default
20
$\begingroup$

… SHA3 (Bouncycastle) constrains me …

Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function.

See, when talking about SHA-3, you're talking about those NIST standards. This was built upon the proposed and accepted keccak sponge function.

NIST standardized SHA-3 to those lengths (which libs like Bouncycastle cover) to match up with the SHA-2 output standard perfectly, so that SHA-3 can be used as an immediate drop-in replacement in case SHA-2 (let's just say) "goes down" one day.

Yet… just because NIST created/fixed those standard output lengths it doesn't mean that the underlying sponge function couldn't be used to create other output lengths.

In the end, the only thing you are missing is the fact that many programming libraries (including Bouncycastle) focus on providing functionality that adheres to standards, not custom functionality.

… is there a specific way to generate "arbitrary length" using bouncy castle implementation …

Well yes, if you look at the BC lightweight API you’ll discover the option to use SHAKE128 and SHAKE256 – which does exactly that. (hint: SHAKEDigest class)

If you think the SHAKE128/256 functions don’t fit your needs (they actually should), that's where programming comes in. If you want something special (read: non-standard), you'll have to grab the core sponge functionality and create your own corresponding functionality you think you need. Libraries like Bouncycastle will hardly be of much use here.

But it's not as if there aren't projects and sourcecode pieces out there on the web that already offer what you are looking for. Simply use your favorite search engine to find them for whatever programming language you deem suitable and fitting your needs.

… standardized version of Keccak is different from the original one that was submitted to NIST …

Yes, you are also correct related to SHA-3 and Keccak being different. They are both sponge functions… but SHA-3 was built upon Keccak, with a small tweak introduced by NIST. This small difference within the sponge functionalities of SHA-3 and Keccak makes them produce different outputs for the same output length.

Practically, both are considered cryptographically secure. So, when wanting arbitrary length of output, you'll have to decide what sponge function you want to use. Looking at Gimli, I'ld like to note that there are other sponge functions out there which are suitable for cryptographic purposes too. Depending on what exactly you need or expect, you have diverse choices.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$
    – e-sushi
    Mar 12, 2018 at 0:05
  • 1
    $\begingroup$ Worth noting, this distinction/confusion also occurs frequently when discussing AES and Rijndael, where AES is the NIST standard configurations of Rijndael, the original algorithm itself was more flexible. $\endgroup$
    – Dev
    Mar 12, 2018 at 13:38
  • $\begingroup$ One thing I find missing from this answer is why truncation or xor-folding is not an answer to OP problem if they want an arbitrary sized output lowered than default? If SHA3 is perfect hash it should be a valid operation (reducing the security by n bits of course). $\endgroup$
    – Maciej Piechotka
    Mar 12, 2018 at 19:07
  • $\begingroup$ @MaciejPiechotka I didn't mention that because OP didn't ask how to derive a lower-sized output but instead "Why is SHA-3 a Sponge function?" as OP wasn't aware of SHAKE functionalities in BC allowing arbitrary length outputs. After pointing OP to the fact such functionality exists in BC, there was no real need to expand endlessly… which is why, at the end of my answer, I wrapped it up writing Depending on what exactly you need or expect, you have diverse choices Listing all options in a single Q&A would quickly become too broad, and go well beyond the scope of what has been asked here. $\endgroup$
    – e-sushi
    Mar 12, 2018 at 23:02
11
$\begingroup$

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity).

SHA-3 defines only these six different hash functions and sub-families:

  • SHA3-224 sets $d = 224$, $r = 1152$, and $c = 448$.
  • SHA3-256 sets $d = 256$, $r = 1088$, and $c = 512$.
  • SHA3-384 sets $d = 384$, $r = 832$, and $c = 768$.
  • SHA3-512 sets $d = 512$, $r = 576$, and $c = 1024$.
  • SHAKE128 sets $r = 1344$ and $c = 256$; $d$ remains variable.
  • SHAKE256 sets $r = 1088$ and $c = 512$; $d$ remains variable.

I'm not familiar with Bouncycastle, but according to their release notes, SHAKE128 and SHAKE256 were implemented with SHA3 in version 2.7.3. You can (and should) use these for outputs of arbitrary lengths.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.