Linked Questions

0 votes
1 answer

Why hash algorithms have many different digest size variants?

1- Why SHA2 has SHA224, SHA256, SHA384 and SHA512 variants? 2- Can we say SHA512 more secure than SHA256? 3- Symmetric ciphers use at most 2^256 security level and I saw on the internet people saying ...
43 votes
2 answers

Is AES-128 quantum safe?

I've been reading lately some contradicting messages with regards to the quantum-safe resistance of AES128. First, there are blog posts by Ericsson people like these ones: Can quantum attackers break ...
2 votes
2 answers

Why is the output size exactly half the capacity for sha-3?

For the SHA-3 family of hash functions, the output size $d$ is always chosen as $d=c/2$, i.e. exactly half the capcity. What is the rational for this? Naively, I think that $d=c$ would make more sense ...
2 votes
1 answer

Grover algorithm for public key cryptography - FrodoKEM

I am wondering if one can apply Grover algorithm on a key encapsulation mechanism in order to crack the shared key. For example, FrodoKEM is a key generation protocol that, for some parameters, shares ...
9 votes
1 answer

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest): Level I: ...
2 votes
2 answers

Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
59 votes
4 answers

Why isn’t SHA-3 in wider use?

SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
13 votes
2 answers

SHAKE-128/256 or SHA3-256/512

Would it be better to use SHAKE-128/256 or SHA3-256/512? In what situation should I chose one over the other?
38 votes
2 answers

What is the difference between SHA-3 and SHA-256?

I am new about cryptography, I learned that SHA-3 (Secure Hash Algorithm 3) is the latest member of the Secure Hash Algorithm family of standards, released by NIST....
0 votes
1 answer

How would Keccak attain a 512-bit security level?

I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that. ...
6 votes
1 answer

What are the implications of quantum collision search algorithms like Ambainis for collision-resistant hash functions?

I just stumbled onto a series of 2017 papers about applying the Ambainis quantum collision-finding algorithm to hash functions. (disclaimer: I haven't read all of them in full yet): Post-quantum ...
2 votes
1 answer

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
34 votes
1 answer

Proof for the SHA3 claim that 256 bit security is "post-quantum sufficient"?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → {25,50,100,200,400,800,...