0
$\begingroup$

So let's say you're trying to do SHA3-224.

If you're on a 64-bit machine you'd presumably use KECCAK-$f$[1600]. In-so-far as I understand it'd have the following parameters:

With a 32-bit machine you'd presumably be using KECCAK-$f$[800] with the following parameters (last table):

  • Rate: 448 (2*224)
  • Capacity: 352 (800 - rate)
  • Rounds: 22 ($12 + 2*\log_2(800/25)$)

Assuming that that's all correct then what I'm wondering about is how the rotation constants would work.

https://keccak.team/files/Keccak-reference-3.0.pdf#page=21 gives a formula for determining the rotation constants: $(t+1)(t+2)/2$ and https://keccak.team/files/Keccak-reference-3.0.pdf#page=22 shows a table with the results of the formula. To get the rotation constants at https://keccak.team/keccak_specs_summary.html you take the lower lower six bits of each of those numbers (eg. $x \land 0x3F$ or $x \mod 64$).

For KECCAK-$f$[800] would you take the lower five bits (eg. $x \land 0x1F$ or $x \mod 32$) of each of those numbers?

A lot of the 32-bit SHA3 implementations I've seen seem to do KECCAK-$f$[1600] and just simulate 64-bit numbers with 2x 32-bit numbers.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

The following two assumptions are mutually incompatible:

you're trying to do SHA3-224

and

with a 32-bit machine you'd presumably be using KECCAK-f[800]

because chapter 6.1 of the SHA-3 Standard FIPS PUB 202 (the link can be found here) defines

$\text{SHA3-224}(M) = \text{Keccak}[448](M \mathbin\Vert 01, 224)$,

but chapter 2.4 of this Standard defines that

$\text{Keccak}[c]$ is the Keccak instance with $\text{Keccak-}f[1600]$ as the underlying permutation and capacity $c$.

Regarding the question about the rotation offsets for $\text{Keccak-}f[800]$ — see chapter 3.2.2 of the SHA-3 Standard FIPS PUB 202 and note that $w=32$. For example, I have seen both the algorithm and the precomputed offsets here:

github.com/XKCP/XKCP/.../KeccakP-800-reference.c.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Chapter 3.2.2 talks about $w = 8$. Why talk about any $w$ other than $64$ if only $\text{Keccak-}f[1600]$ (with $w = 64$) is used? $\endgroup$
    – neubert
    Commented Aug 7, 2018 at 13:51
  • 1
    $\begingroup$ @neubert: Because SHA-3 function is derived from Keccak, so Keccak is defined before SHA-3 function specifications. Chapter 3.2.2 contains an illustration of RHO for the case $w = 8$ in Figure 4, but Algorithm 2 is defined for all possible values of $w$. See Table 1 in chapter 3.1. But SHA-3 function specifications are given in chapter 6 of this Standard. The width of the underlying permutation of SHA-3 is 1600 bits, which corresponds to $w = 64$. $\endgroup$
    – lyrically wicked
    Commented Aug 8, 2018 at 4:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.