Questions tagged [blake2]

BLAKE2 is a cryptographic hash function based on the SHA-3 finalist BLAKE

Filter by
Sorted by
Tagged with
2 votes
1 answer
60 views

Rationale for BLAKE2 message schedule?

BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block. The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
LightTunnelEnd's user avatar
0 votes
0 answers
70 views

BLAKE2s finding a hash collision [duplicate]

I want to find a hash collision for Blake2 with 32 bit digest length such that i have 2 messages that produce an identical hash digest. How would you do that? is there another option than just ...
Guestlian's user avatar
2 votes
1 answer
244 views

Is Argon2 based on BLAKE2b or is it only using the BLAKE2b at the end?

What's the exact meaning of 'Argon2 uses BLAKE2b'? Does it based on BLAKE2b? like chacha20 based on salsa20 kind of meaning or does Argon2 use the BLAKE2b with 12 rounds hash function at the end to ...
user avatar
1 vote
1 answer
116 views

Is BLAKE2X suitable for generating keys with any security in bits event if BLAKE2 having only 256/512-bits?

I can generate a key of any security in bits with any hash function from random source with enough entropy by using the following scheme: $$H(00||S) || H(01||S) || H(02||S) || H(03||S) || \cdots$$ /\ ...
phantomcraft's user avatar
2 votes
1 answer
83 views

Is a compression function call the same as invoking the hash function itself?

In BLAKE2X paper it is said: BLAKE2X adds a constant overhead of $\lceil\ell/64\rceil$ (resp. $\lceil\ell/32\rceil$ compression function calls compared to the underlying 64-bit (resp. 32-bit) BLAKE2 ...
phantomcraft's user avatar
0 votes
2 answers
231 views

Use blake2 permutation as a block cipher

Blake2(1024 bit state) permutation (compression function core) is basically a modified ChaCha permutation. One of the modifications is to mix in message bits (key schedule?). Given that blake2 is a ...
Alexandra Tr.'s user avatar
1 vote
1 answer
118 views

Offset Parameters in BLAKE2b

In my course about cryptography, we started looking at hash functions. As homework, we had to pick a modern hash function and describe it in class. I chose BLAKE2b, which I can understand well when ...
soul king's user avatar
0 votes
0 answers
116 views

Questions about Blake2x: Its state size (internal state) and its security when generating keys with size more than 256/512bits

I read the Blake2x paper: https://www.blake2.net/blake2x.pdf It says Blake2x can be used to build a "DRBG" (CSPRNG): https://csrc.nist.gov/glossary/term/deterministic_random_bit_generator &...
phantomcraft's user avatar
3 votes
1 answer
312 views

How is Argon2's Blake2b different than normal Blake2b?

This post says that Argon2's Blake2b is a reduced one, which is also agreed by Argon2's specs as it states that it uses only a 2 round Blake2b. But, on the other hand, page ...
caveman's user avatar
  • 573
1 vote
1 answer
116 views

How many times is Blake2b called with Argon2?

How many times is Blake2b called with Argon2? Say argon2 thisissomesalt -d -k 1048576 -p 4 -t 20.
caveman's user avatar
  • 573
1 vote
0 answers
292 views

Lightweight encrypting for BLE advertising packets

I'm new to encryption and this is my first time working with it. I'm currently working on a home project which consists of the equipment in my garage to be attached with a BLE device which sends ...
nbafanatic's user avatar
2 votes
1 answer
891 views

Post quantum security of the BLAKE family

Is there any proof that BLAKE (including 2 and 3) is post-quantum secure? We know that as Merkle–Damgård (with proper padding) preserves collapse sha2 is post-quantum secure. I know that the sponge-...
augustus's user avatar
2 votes
1 answer
1k views

Can Blake2 be a replacement for double SHA-256?

Is it a good choice to drop double SHA-256 and use straight Blake2 in a Bitcoin-like blockchain (more POS oriented so it's not a mining problem)? I'm talking about Blake2 because I've read more about ...
Not Important's user avatar
0 votes
2 answers
323 views

What is the runtime complexity of the `BLAKE2` hash function?

Assume you want to calculate the blake2 hash function for an arbitrary input of $n$ bytes. I am wondering about the runtime, in particular: Does the runtime of ...
networkstudent's user avatar
2 votes
0 answers
155 views

How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?

I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them. For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
DannyNiu's user avatar
  • 9,080
3 votes
1 answer
392 views

Why HAIFA and sponge constructions are not prone to length extension attacks?

I was writing in a document about the flaws of the MD construction which pushed cryptographers to create different and more robust constructions. However, I don't know why HAIFA and Sponge ...
Hinton Zsh's user avatar
1 vote
1 answer
521 views

Understanding the HAIFA (hash iterative framework) structure

Unfortunately, this structure doesn't even have a full Wikipedia on it. I'm struggling to understand it. There are no Youtube videos, Lectures, or any educational video on it. I want to understand how ...
Hinton Zsh's user avatar
4 votes
2 answers
2k views

Why blake2b is the fastest despite it being 512 bits hashing algorithm?

I am struggling to understand why blake2b is faster than blake2s, despite that blake2b is 512 bits hashing. I hope someone can clarify that for me. I read the official paper for blake2b, but I am not ...
Hinton Zsh's user avatar
4 votes
1 answer
767 views

Is Blake2b vulnerable to length extension attacks?

There are very few resources for Blake2b apart from the official documentation and website. I would like to know if Blake2b is not vulnerable to length extension attacks unlike SHA2. I would like your ...
Hinton Zsh's user avatar
10 votes
1 answer
1k views

Why invent new hash functions for zero-knowledge proofs?

Recently, new hash functions were invented. Their primary purpose is serving the needs of zero-knowledge proof systems. I'm talking about Poseidon-256, Starkad-256, etc. See the paper. What is the ...
Paul Miller's user avatar
0 votes
1 answer
157 views

Fooling Proof-of-Storage Protocols. What's the difference with Length-Extension attack?

I've searched a bit for this question, but I haven't found anything, so I've decided to post it here. Lately I've been reading "Serious Cryptography: A Practical Introduction to Modern Encryption" by ...
Nicolas R's user avatar
6 votes
2 answers
1k views

BLAKE2: What is the difference between the salt and the personalization?

Libsodium builds their KDF on top of BLAKE2b: BLAKE2B-subkeylen(key=key, message={}, salt=subkey_id || {0}, personal=ctx || {0}) Besides the key, the function ...
Danilo Bargen's user avatar
2 votes
1 answer
168 views

Is iterative sha256 adequate for local password manager?

I'm fairly entry-level crypto; not a cryptographer by any stretch... I am at the level of ability to implement most of the traditional packages in python; the hashlib hashes and EAS, ECDSA ...
litepresence's user avatar
16 votes
3 answers
2k views

Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE? What's wrong with using the core ChaCha ...
Charlie's user avatar
  • 374
0 votes
1 answer
271 views

blake2b length extension attack approach

I understand that a completion flag parameter with Boolean value of 1 is used by Blake2 when it’s compressing the final block of the digested message. This ensures that one cannot load the state of a ...
Woodstock's user avatar
  • 1,384
9 votes
0 answers
556 views

Why is BLAKE2 faster than chacha20?

Chacha20 is essentially a hash function that maps 512-bit strings to other 512-bit strings which are in turn xored with the plaintext to create the ciphertext. Of the 512-bit input 128-bit are used ...
Astolfo's user avatar
  • 149
5 votes
3 answers
5k views

Blake2 vs md5 for checksum / file integrity

I'm working on something that requires computing a checksum / file integrity. I've heard MD5 was no longer recommended. Should I use Blake2 instead? Is there a specific variant of Blake2 I should use ...
aroooo's user avatar
  • 183
5 votes
2 answers
235 views

Early propagation of carries in the BLAKE hash function

The BLAKE paper uses round constants derived from $\pi$ to improve diffusion, even if the additions modulo $2^{32}$ are replaced with bitwise XOR when processing a null message and null initial state: ...
forest's user avatar
  • 15.2k
4 votes
1 answer
1k views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet large ...
Marc Ilunga's user avatar
  • 3,163
4 votes
2 answers
2k views

Is there any concrete reason to call BLAKE more secure than BLAKE2? [duplicate]

I read a blog article which discussed SHA-3. I noticed it mention that security was often compromised in the name of speed (not always a bad thing, of course). It gave some examples: What I'm ...
forest's user avatar
  • 15.2k
3 votes
1 answer
2k views

Security of XORing hashes vs concatenating

On this question https://stackoverflow.com/questions/5889238/why-is-xor-the-default-way-to-combine-hashes a couple of the answers say that xoring is a bad/insecure choice for combining hashes. However,...
Lev Knoblock's user avatar
6 votes
1 answer
2k views

Recommended key lengths for BLAKE2b

RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes): ...
user42529's user avatar
  • 103
4 votes
0 answers
227 views

Is it safe to extend the length of Blake2b’s keyed hash key?

Blake2b keyed hash variation specifies a maximum key length equal to the digest size. It implements this feature simply concatenating the zero-padded key to a boundary of the block size with the ...
user3368561's user avatar
9 votes
2 answers
8k views

Argon2 with SHA-256 instead of Blake2

Can SHA-256 be substituted for Blake2 in the Argon2 algorithm? I am working my way through the C reference source code for Argon2 and hand-translating it to Go. I was just wondering why Blake2 was ...
Ralph's user avatar
  • 375
8 votes
3 answers
3k views

Blake2B as a KDF

How would one go about using vanilla keyed Blake2B as a KDF with high-entropy inputs. Assume I don't have access to more specialized algorithms such blake2XB, HKDF, etc. Salt - high entropy per-...
hunter's user avatar
  • 3,955
11 votes
1 answer
15k views

Should I use SHA256 or Blake2 to checksum and sign scrypt headers?

I use scrypt as a key derivation function (not to store passwords). To pass around the detached key header I use the standard encoding as implemented in Colin Percival's scrypt implementation (...
RobS's user avatar
  • 113
0 votes
2 answers
1k views

Creating UID's using hash functions - most appropriate hashing algorithm?

I have circa 1 million datapoints, each with a unique integer ranging from 6 to 24 digits: ...
Babra Cunningham's user avatar
2 votes
1 answer
170 views

Is the use of a 4-round Blake2b permutation in OPP justified?

The MEM-AEAD construction uses a 4-round Blake2b permutation in masked Even-Mansour mode as a (tweakable) block cipher. 4 rounds of the Blake2b permutation are already broken to my knowledge. Why ...
Demi's user avatar
  • 4,793
5 votes
0 answers
217 views

Can an analog of ChaCha with 64-bit words be defined, and would it be secure? [duplicate]

Blake2b has a lightning fast compression function with more-than-overkill security even against quantum attacks. It seems to be based on ChaCha, but with 64-bit words and different rotation constants....
Demi's user avatar
  • 4,793
2 votes
2 answers
346 views

Misuse-resistant authenticated encryption based on SHA-3/Blake2b and AES-CTR/ChaCha20

I am wondering if the following is a useful misuse-resistant authenticated encryption scheme: Parameters (shared by many users): Choose a hash function $H$, such as Blake2 or Keccak. SHA2 could ...
Demi's user avatar
  • 4,793
58 votes
2 answers
20k views

What advantages does Keccak/SHA-3 have over BLAKE2?

Keccak/SHA-3 is new NIST standard for cryptographic hash functions. However, it is much slower than BLAKE2 in software implementations. Does Keccak have compensating advantages?
Demi's user avatar
  • 4,793
6 votes
1 answer
1k views

Blake2: truncate 512-bit hash is safer than 256-bit by Config?

I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ...
David BS's user avatar
  • 197
4 votes
1 answer
115 views

Can a tree hash with leaf-size of 1 byte support verification of content with elided ranges, at a cost of at most 2 supplied internal-node hashes?

Perhaps someone can confirm my intuition: A tree hash with leaves of size 1 (for example Blake2 in a tree-hash mode) would of course not be very efficient. But it seems that it might be a suitable ...
gojomo's user avatar
  • 221
3 votes
2 answers
571 views

How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?

Suppose I have two arrays : A = a single byte, being zero. B = two bytes, both being zero. B = A||0 (i.e. B starts with A, and differs only by appending a zero byte) BLAKE2(A) != BLAKE2(B) Yet, ...
Usas's user avatar
  • 43
3 votes
0 answers
647 views

Infinite depth BLAKE2b tree hashing

In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] (...
Stephen Touset's user avatar