For encryption authentication, I am using ECDSA signatures over the curve secp521r1. There is a hash function parameter, and as the curve is 521-bit, the hash output length should be > 512 bits, which is the highest offered output of the Standard SHA-2 hashes available.

However, in the SHA-3 specification, the cSHAKE function allows for variable length outputs, so is it recommended to use cSHAKE with an output length of something like 521 < n < 1024. If so, what is the recommended hash length to use?

  • $\begingroup$ It's a good question—and I don't know offhand what NIST's recommendations are for ECDSA over P-521, or whether there was any approved hash function for it prior to SHA-3—but why do you want to do this? There's no meaningful security advantage over, say, secp256k1, which naturally has a substantial performance advantage and also has high-quality implementations (particularly libsecp256k1) readily available. And, if you're not restricted to NIST approval or FIPS rubber-stamping, you should use Ed25519 (or Ed448 if you really want a hedge against a modest cryptanalytic advance at any cost). $\endgroup$ – Squeamish Ossifrage Nov 5 '19 at 19:06
  • $\begingroup$ For comparison, Ed448, which works over a group of 446-bit order, is defined to use SHAKE256-912—in general, EdDSA chooses the hash to be twice the size of the order, to confidently avoid any modulo bias. (This strategy paid off in another part of EdDSA vs. ECDSA.) Certainly it wouldn't be wrong to choose SHAKE256-1024 for use with secp521r1, under the somewhat questionable premise of using secp521r1 in the first place. $\endgroup$ – Squeamish Ossifrage Nov 5 '19 at 19:17

The hash output length does not need to be larger than 512 bits; the ECDSA specification can handle any length. The curve secp521r1 is usually considered to provide 256 bits of security (even though it provides a bit more), see Table 2 of NIST SP 800-57 for example. Therefore, a 512-bit hash, i.e. SHA-512, should be fine ("The security strength of the hash function used shall meet or exceed the security strength associated with the bit length of n", NIST FIPS 186-4)

Regarding cSHAKE (you probably meant SHAKE; cSHAKE is its customizable variant that is used to define KMAC and TupleHash), you could use any output equal to or larger than 512 bits. The NIST FIPS 186-5 draft mandates SHAKE256 with 512-bit output.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.