Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I am new about cryptography,
I learned that SHA-3 (Secure Hash Algorithm 3) is the latest member of the Secure Hash Algorithm family of standards, released by NIST.
But I recently saw SHA-256 but I don't get what is it in comparison to SHA-3 ?
The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are:
Resistance to length extension attacks. With SHA-256, given $H(m)$ but not $m$, it is easy to find $H(m \mathbin\| m')$ for certain suffixes $m'$. Not so with any of the SHA-3 functions.
This means, e.g., that $m \mapsto H(k \mathbin\| m)$ is not a secure message authentication code under key $k$ when $H$ is SHA-256, because knowing the authenticator on one message lets you forge the authenticator on another. The length extension property partly moviated the development of HMAC.
In contrast, the key-prefix construction is secure as a MAC when $H$ is any of the SHA-3 functions—or either of the newer SHA-2 functions SHA-512/224 and SHA-512/256. For SHA-224, which is essentially the 224 bit truncation of SHA-256 (but with a different IV), the adversary has a $2^{-32}$ chance of guessing the discarded bits of output in a single trial—small but not negligible.
Performance. The SHA-2 functions—particularly SHA-512, SHA-512/224, and SHA-512/256—generally have higher performance than the SHA-3 functions. Partly this was out of paranoia and political reasons in the SHA-3 design process.
(In response, one of the SHA-3 finalists was spun out into the much faster BLAKE2, also widely used on the internet today, and the SHA-3 winner Keccak was spun out into the much faster KangarooTwelve.)
Completely different internal design. SHA-2 uses the Davies–Meyer structure, an instance of the Merkle–Damgård structure, with a block cipher (sometimes called SHACAL-2) built out of an ARX network, like MD4; SHA-3 uses the sponge structure with the Keccak permutation.
There is no user-visible difference here, but it made a difference for cryptographers' confidence in the designs after many DM/ARX designs based on MD4 were broken in the late '90s and early 2000s.
History. There has been a long line of hash functions standardized by NIST in FIPS 180, the Secure Hash Standard, and later FIPS 202¸ the SHA-3 Standard: Permutation-Based and Extendable-Output Functions. More details and history, including the related MD4 and MD5 hash functions on which SHA-0, SHA-1, and SHA-2—but not SHA-3—were based:
\begin{equation} \begin{array}{ccc} \text{hash} & \text{year} & \text{coll. res.} & \text{size (bits)} & \text{design} & \text{broken?} \\ \hline \text{MD4} & 1990 & 64 & 128 & \text{32-bit ARX DM} & 1995 \\ \text{SHA-0 (SHA)} & 1993 & 80 & 160 & \text{32-bit ARX DM} & 1998 \\ \text{MD5} & 1993 & 64 & 128 & \text{32-bit ARX DM} & 2004 \\ \text{SHA-1} & 1995 & 80 & 160 & \text{32-bit ARX DM} & 2005 \\ \hline \text{SHA-256 (SHA-2)} & 2002 & 128 & 256 & \text{32-bit ARX DM} & \\ \text{SHA-384 (SHA-2)} & 2002 & 192 & 384 & \text{64-bit ARX DM} & \\ \text{SHA-512 (SHA-2)} & 2002 & 256 & 512 & \text{64-bit ARX DM} & \\ \hline \text{SHA-224 (SHA-2)} & 2008 & 112 & 224 & \text{32-bit ARX DM} & \\ \text{SHA-512/224} & 2012 & 112 & 224 & \text{64-bit ARX DM} & \\ \text{SHA-512/256} & 2012 & 128 & 256 & \text{64-bit ARX DM} & \\ \hline \text{SHA3-224} & 2013 & 112 & 224 & \text{64-bit Keccak sponge} & \\ \text{SHA3-256} & 2013 & 128 & 256 & \text{64-bit Keccak sponge} & \\ \text{SHA3-384} & 2013 & 192 & 384 & \text{64-bit Keccak sponge} & \\ \text{SHA3-512} & 2013 & 256 & 512 & \text{64-bit Keccak sponge} & \\ \text{SHAKE128} & 2013 & {\leq}128 & \text{any} & \text{64-bit Keccak sponge} & \\ \text{SHAKE256} & 2013 & {\leq}256 & \text{any} & \text{64-bit Keccak sponge} \end{array} \end{equation}
In 1993, NIST published FIPS 180, the Secure Hash Standard, defining SHA-0, originally just named SHA for Secure Hash Algorithm, intended for use with the newly published DSA. SHA-0 is a single 160-bit hash function aimed at 80-bit collision security (and now completely broken), based on the relatively new and fast design of MD4 in 1990.
In 1995, NIST quietly withdrew FIPS 180 and replaced it by FIPS 180-1 defining SHA-1, which differs from SHA-0 by the inclusion of a single one-bit rotation. Like SHA-0, SHA-1 is a single 160-bit hash function aimed at 80-bit collision security (and now completely broken).
No public explanation was given for the change, but it was not long prior that Eli Biham had published differential cryptanalysis and the academic community realized that the NSA's tweaks to the DES S-boxes in the 1970s actually improved security (never mind that they reduced the 128-bit key size of Lucifer to 56 bits for DES, completely destroying security at the same time). The same year, Dobbertin broke MD4[1], and the next year, severely damaged MD5[2]. Not long after that, in 1998, Florent Chabaud and Antoine Joux reported a $2^{61}$-cost collision attack on SHA-0[3].
In 2002, NIST published FIPS 180-2, defining SHA-2, a family of related hash functions with different sizes: SHA-256, SHA-384, and SHA-512, named for their output sizes and aiming respectively at 112-, 128-, 192-, and 256-bit collision resistance. The SHA-2 functions continued the design principles of MD4, MD5, SHA-0, and SHA-1, with more rounds and bigger state. Not long after that, in 2004, Xiaoyun Wang's team reported full collisions on MD5 and other hash functions[4], and in 2005, published a $2^{69}$-cost attack on SHA-1[5], substantially cheaper than generic. With many of the designs based on MD4 having been broken now, the everyone got nervous about that design, so…
In 2007, NIST launched the SHA-3 competition to design a successor to SHA-2, in case the design turned out to be bad. The competition would take place over several years.
Meanwhile, in 2008, NIST updated the Secure Hash Standard with FIPS 180-3, adding SHA-224 to the SHA-2 family, and then in 2012, NIST updated it again with FIPS 180-4 (2012), adding SHA-512/224 and SHA-512/256, faster 256-bit and 384-bit hash functions on 64-bit machines with resistance to length extension attacks that let one compute $H(m \mathbin\| m')$ given $H(m)$ and certain $m'$ without knowing $m$.
In 2013, the SHA-3 competition concluded with Keccak as NIST's chosen winner, which they published in FIPS 202. SHA-3 includes four fixed-size hash functions, SHA3-224, SHA3-256, SHA3-384, SHA3-512, and two extendable-output hash functions SHAKE128 and SHAKE256 which attain up to a 128-bit or 256-bit security level if the output is long enough.
The design of SHA-3 is completely different from SHA-2, which gives confidence that cryptanalytic breakthroughs on line of designs based on MD4 probably won't affect SHA-3, although a decade and a half after the bloodbath of the early 2000s there hasn't been much progress on SHA-2 either. The parameters chosen for the fixed-size SHA-3 functions were kind of accidentally overdesigned for political reasons[6], so SHA-3 functions like SHA3-256 are slower than they need to be, and you should generally just use SHAKE128 or SHAKE256.
The main difference of SHA256 and SHA3 are their internal algorithm design.
SHA2 (and SHA1) are built using the Merkle–Damgård structure.
SHA3 on the other hand is built using a Sponge function and belongs to the Keccak-family.
The name might be misleading to think that SHA3 in comparison to SHA2 is just a "newer" version of the algorithm. As SEJPM said: "[...] They share very little beyond the name." The name is just given from NIST and means "Secure hashing algorithm", a family of official standards.
Although you can construct MACs with both SHA256 and SHA3, the SHA3 MAC is easier to use (see fgrieu's comment below).
SHA256 outputs a 256-bit hash.
SHA3 allows outputs of
hash, although the SHA2-variants (SHA256 is one of these variants) also allows for these lengths.
SHA3 algorithms can be modified to "SHAKE" algorithms and they allow a output of arbitrary length. You can find additional info in this previously asked question.
Hashes that only make use of the Merkle–Damgård structure and output their full (or nearly full) state are vulnerable to length extension attacks.
SHAKE algorithms are also useful for Optimal asymmetric encryption padding.
You can view a direct comparison here (wikipedia).
