Linked Questions

59 votes
4 answers
19k views

Why isn’t SHA-3 in wider use?

SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
RixN's user avatar
  • 782
38 votes
2 answers
68k views

What is the difference between SHA-3 and SHA-256?

I am new about cryptography, I learned that SHA-3 (Secure Hash Algorithm 3) is the latest member of the Secure Hash Algorithm family of standards, released by NIST....
Ced's user avatar
  • 515
43 votes
2 answers
13k views

Is AES-128 quantum safe?

I've been reading lately some contradicting messages with regards to the quantum-safe resistance of AES128. First, there are blog posts by Ericsson people like these ones: Can quantum attackers break ...
Jimakos's user avatar
  • 755
34 votes
1 answer
6k views

Proof for the SHA3 claim that 256 bit security is "post-quantum sufficient"?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → {25,50,100,200,400,800,...
e-sushi's user avatar
  • 17.9k
13 votes
2 answers
8k views

SHAKE-128/256 or SHA3-256/512

Would it be better to use SHAKE-128/256 or SHA3-256/512? In what situation should I chose one over the other?
Alejandro Martinez's user avatar
9 votes
1 answer
3k views

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest): Level I: ...
gorte's user avatar
  • 167
2 votes
2 answers
401 views

Why is the output size exactly half the capacity for sha-3?

For the SHA-3 family of hash functions, the output size $d$ is always chosen as $d=c/2$, i.e. exactly half the capcity. What is the rational for this? Naively, I think that $d=c$ would make more sense ...
Simon's user avatar
  • 123
2 votes
2 answers
793 views

Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
SamG101's user avatar
  • 613
2 votes
1 answer
335 views

Grover algorithm for public key cryptography - FrodoKEM

I am wondering if one can apply Grover algorithm on a key encapsulation mechanism in order to crack the shared key. For example, FrodoKEM is a key generation protocol that, for some parameters, shares ...
C.S.'s user avatar
  • 435
6 votes
1 answer
512 views

What are the implications of quantum collision search algorithms like Ambainis for collision-resistant hash functions?

I just stumbled onto a series of 2017 papers about applying the Ambainis quantum collision-finding algorithm to hash functions. (disclaimer: I haven't read all of them in full yet): Post-quantum ...
Mike Ounsworth's user avatar
0 votes
1 answer
417 views

How would Keccak attain a 512-bit security level?

I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that. ...
Lev Knoblock's user avatar
0 votes
1 answer
292 views

Why hash algorithms have many different digest size variants?

1- Why SHA2 has SHA224, SHA256, SHA384 and SHA512 variants? 2- Can we say SHA512 more secure than SHA256? 3- Symmetric ciphers use at most 2^256 security level and I saw on the internet people saying ...
user avatar
2 votes
1 answer
351 views

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
Zachary's user avatar
  • 177