In general terms, NORX works combining a cryptographic hash function and an stream cipher. At the end of an encryption operation you end with a ciphered message plus its authenticated hash. If you call AEADEnc() whith a zero length secret and postfix message, you basically get a hash function for each $(key, nonce)$ pair.

My question is, given a fixed and public $(key, nonce)$ pair, can NORX AEADEnc() work as a secure cryptographic hash function?

  • $\begingroup$ the capacity is too low, and would probably need double the round count $\endgroup$ Jul 5, 2018 at 4:22
  • $\begingroup$ @RichieFrame There is a 6 rounds variant that is still fast enough. This is not a problem. What to do with capacity? Are there any references about it? $\endgroup$ Jul 5, 2018 at 8:43
  • $\begingroup$ by double I mean 12 = double of 6, norx is a sponge function, so it has a capacity that relates to its security, and norx64 has a capacity of 256-bits, which is appropriate for a 128-bit hash function $\endgroup$ Jul 5, 2018 at 10:02
  • $\begingroup$ @RichieFrame By 128-bits hash function you mean a 128-bits of security and 256-bit digest size (birthday paradox) or a 64-bits of security and 128-bits digest size? $\endgroup$ Jul 5, 2018 at 10:51
  • $\begingroup$ 128-bits of security, but you would need to output 256-bits of tag $\endgroup$ Jul 5, 2018 at 20:20

1 Answer 1


What security goals are you hoping for?

If NORX is a secure nonce-based AEAD as advertised (which it may or may not be—CAESAR dropped it and it's not widely deployed, so there's little incentive to study it), then what it will guarantee, as a nonce-based MAC, is antiforgery. Specifically, no cost-limited adversary who can query an oracle ‘NORX-MAC’ for a single message under a single nonce can forge an authenticator for another message under that nonce.

But, for this security goal, there are much faster choices like Poly1305-AES. If you want a stronger security goal, like a nonceless MAC or a PRF such as HMAC-SHA256 or keyed BLAKE2s or KMAC256 are conjectured to be, NORX may or may not provide that: it's not advertised as a security goal of NORX. If you're looking for collision resistance, it's unlikely that you'll find it in NORX as is.

  • $\begingroup$ The nice thing about NORX vs AES/ChaCha20-Poly1305 is its that its unoptimized reference C implementation is very fast (3 CPB in my machine). Sure an optimized implementation of AES/ChaCha20-Poly1305 outperforms an optimized implementation of NORX (with p=1), but not all platforms have the luxury of having one. Moreover, AES/ChaCha20-Poly1305 plus a hash are three algorithms. This means a greater attack surface, greater opportunities to introduce bugs, and three times more effort to deploy it on new platforms. $\endgroup$ Jul 5, 2018 at 8:30
  • $\begingroup$ My security goal is at least 128 bits of security. $\endgroup$ Jul 5, 2018 at 8:32
  • $\begingroup$ @user3368561 ‘128-bit security’ is not a security goal. Examples of security goals: pseudorandom function family, or PRF security meaning adversary can't distinguish the family under uniform random key from a uniform random function; message authentication code, or EUF-CMA (existential unforgeability under chosen message attack) meaning adversary mounting chosen-message attack can't find any message and authenticator pair; collision resistance, meaning adversary given random key can't find collision with nonnegligible probability; ((enhanced) target) preimage resistance; etc. $\endgroup$ Jul 5, 2018 at 22:26
  • $\begingroup$ @user3368561 Can a fork function as a spoon? Well, yes, you can get a few drops of soup on a fork, so with a lot more forkfuls of soup you can eat it as if you had a spoon. I'm not asking how big a utensil you're looking for—I'm asking what kind of utensil you're looking for. $\endgroup$ Jul 5, 2018 at 22:27
  • 1
    $\begingroup$ @user3368561 libhydrogen is cute because it is conceptually simple using the versatile tool of sponge constructions, and admits a small implementation. But small implementation doesn't mean efficient implementation, and things like collision resistance cost much more than things like low collision probability. Gimli is still a new design; NORX is not as new, but it's not likely to receive any new scrutiny. Can you get high performance for standard security levels in a variety of security goals on a variety of architectures using a single primitive? Crypto.SE can't really tell you. $\endgroup$ Jul 6, 2018 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.