Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [keccak]

SHA-3, originally known as Keccak, is a cryptographic hash function designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.

4
votes
1answer
87 views

Is it reasonable to assume that $\text{Keccak-}f[25n]$ block permutation is defined for any value of $n$?

Wikipedia contains the following claim for $\text{Keccak-}f[25w]$: It is defined for any power-of-two word size, $w = 2^ℓ$ bits. Although all official descriptions of Keccak do not explicitly ...
1
vote
1answer
97 views

Given a particular $1600$-bit output $Y$, is it feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?

I have read this answer on Crypto.SE and I want to clarify a few details. Does this property of $\text{Keccak-}f[1600](x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible ...
1
vote
1answer
61 views

Capacity bits in SHA-3

I am trying to understand the sponge construction, and in the official web site I found this sentence: The last c bits of the state are never directly affected by the input blocks and are never ...
3
votes
2answers
150 views

Intuition for SHA3 sponge construction

I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation. Let's consider the case where we have don't apply $f$ in the squeezing ...
3
votes
1answer
124 views

What does Keccak being “efficiently invertible” mean?

Reading through Wikipedia, I saw this: It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge ...
0
votes
2answers
68 views

What is a permutation in Keccak?

I am trying to understand Ethereum's hash algorithm Keccak. Keccak uses permutations in the hashing process. Could anyone explain me what this permutation looks like or how it works ? I only know ...
0
votes
0answers
32 views

Simplifying the description of the Keccak padding rules

I would like to check if my following understanding of Keccak padding has any flaws and if there are, please feel free to point them out and correct them. The Keccak version I am interested is the ...
1
vote
1answer
52 views

shake-128 in 32-bits platform

I am implementing shake in 32-bits microcontroller, so I would like to use bit interleaving. I checked the code in: https://github.com/floodyberry/supercop/blob/master/crypto_hash/keccak/simple32bi/...
0
votes
1answer
115 views

rotation offsets for KECCAK-$f$[800]

So let's say you're trying to do SHA3-224. If you're on a 64-bit machine you'd presumably use KECCAK-$f$[1600]. In-so-far as I understand it'd have the following parameters: Rate: 448 (2*224) ...
5
votes
2answers
180 views

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

$\require{begingroup}\begingroup \DeclareMathOperator{\keccak}{\mathrm{Keccak}} \DeclareMathOperator{\concat}{\|} $According to Keccak's website, $\keccak(k \concat x)$ is safe: Unlike SHA-1 and ...
3
votes
1answer
111 views

why was padding changed when keccak became sha3?

In the original Keccak you would pad by adding a 1 bit proceeded by a predetermined amount of 0 bits and then another 1 bit. When Keccak was standardized to sha3 the padding was changed. It was then (...
1
vote
2answers
173 views

Best way, how to convert 32-byte Keccak hashes to positive numbers up to maximum?

I have 32-byte Keccak hashes and I have some maximum number, for example 500, how to uniformly convert those hashes to pseudo-random positive numbers up to that ...
6
votes
1answer
418 views

What is the size of codomain of a function $G(x) = F^A(x) \oplus F^B(x)$, where $F(x) = \text{Keccak-}f[1600](x)$?

Assuming that $m$ is a multiset of bitstrings where all bitstrings have the same length, let $D(m)$ denote the number of distinct elements in $m$. That is, $D(m)$ is equal to the dimension of $m$. For ...
3
votes
1answer
59 views

Are there known special cases where the first 160 bits of keccak256 can be null ? Or does finding a collision is required?

In the Tronix contract code (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers : ...
3
votes
2answers
109 views

What are the consequences if someone finds the accessible 1600-bit block $X$ and $R$-bit block $V$ such that $\text{Keccak-}f[1600](X \oplus V) = X$?

Let $H$ denote any hash function based on the sponge construction. Let $F$ denote its underlying function that transforms the $L$-bit state (for SHA-3, $F = \text{Keccak-}f[1600]$ ). Let $R$ denote ...
2
votes
1answer
269 views

Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
1
vote
1answer
212 views

Security of XORing hashes vs concatenating

On this question https://stackoverflow.com/questions/5889238/why-is-xor-the-default-way-to-combine-hashes a couple of the answers say that xoring is a bad/insecure choice for combining hashes. However,...
0
votes
1answer
64 views

Identify Keccak Algorithm

I need to analyse a binary code and check if Keccak is used in this code. I can identify AES, by using Rijndael S-box. Is there a similiar box for Keccak?
2
votes
0answers
134 views

Closest Keccak256 hashes by Hamming distance? [closed]

What are the two "closest" known Keccak256 (not SHA-3 256) hashes in terms of the Hamming distance between the pair of hashes? EDIT: This was marked as opinion based, so to clarify, when I asked this ...
2
votes
0answers
207 views

SHA3 hardware implementation [closed]

I am studying SHA3 in order to create a hardware implementation, preferably in verilog. I have downloaded VHDL reference implementation from https://keccak.team/hardware.html. The code is great, and ...
0
votes
1answer
241 views

0.75 confidence in bit prediction through $\chi^{-1}$

When checking the S-Box implementation of $\chi$ in Keccak I wanted to see if there were any fixed bits in the forward direction of $\chi$ that could be leverage to reveal truncated state bits. I ...
0
votes
0answers
107 views

How would Keccak-1024

I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that. ...
11
votes
2answers
4k views

Why is SHA-3 a Sponge function?

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
4
votes
1answer
138 views

Strength of Hash obtained by XOR of parts of SHA3

I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail has the last 64 bits. Next, I XOR head and tail. Which ...
1
vote
1answer
587 views

Use sha3 for passwords hashing

Is use of sha3 justifiable? Is sha3 better than sha2 in (m)any aspects? P.S. I want to use hashing for passwords in a database
5
votes
2answers
369 views

Using Keccak permutation as a block cipher

The inverse of Keccak is slow, but if you have a problem where that is not a concern would this be a secure cipher? The encryption function can be made incredibly fast in hardware. Or the reverse if ...
3
votes
1answer
253 views

What is an extendable output function?

The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
0
votes
1answer
250 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
0
votes
1answer
181 views

Correct integer input value for keccak 256 [closed]

Assuming that we use k = sha3.keccak_256()(pysha3 package). How should one convert integer input for a function ...
4
votes
3answers
583 views

What is the current time limit of Keccak inversion? [closed]

All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this ...
0
votes
1answer
91 views

What are the properties of a function based on multiple iterations of a pseudo-random permutation?

Let $F(S) = \text{Keccak-}f[1600](S)$. Assuming that the length of $S$ is equal to $1600 \times k$ and if $k$ is greater than $1$, we define a function $F_{k}(S)$ as follows. We note that $S$ is ...
3
votes
0answers
93 views

What is the expected number of different sequences of bits in the collection that contains $2^{800}$ elements?

Let $F$ denote a function that returns the first $800$ bits of the input. Let $G(N)$ denote a function that returns the last $800$ bits of the binary encoding of the given number $N$. For example, ...
2
votes
1answer
104 views

Is the Keccak family of sponge constructions the same as SHA-3?

I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as ...
4
votes
1answer
122 views

Is it theoretically possible for the output of SHAKE to be an infinite concatenation of the same 512-bit block?

Let $X$ denote a particular 512-bit sequence. Let $A,B,C$ denote sequences of bits such that: $$len(X || A) = len(X || B) = len(X || C) = 1600$$ $$\operatorname{Keccak-}f(X||A) = X||B$$ $$\...
3
votes
0answers
118 views

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
3
votes
1answer
166 views

Reasoning behind SHA-3 state array indexing

I was reading through the SHA3 standard (https://dx.doi.org/10.6028/NIST.FIPS.202) and in the standard it defines how to construct 3D state array from a 1D array. The state array is defined as ...
1
vote
1answer
347 views

Shake 128/256 Output Length Restrictions

Are there any restrictions on the specified output length when using shake-128 or shake-256, to the extent that certain output lengths should be avoided/or not used entirely? Edit: If someone ...
6
votes
0answers
290 views

Why is Keccak-f reversible? [duplicate]

It seems like the Keccak permutation is reversible, which is not making the output of SHAKE forward-secure. In the sense that if one state is leaked, everything can be recovered. I wanted to know the ...
6
votes
2answers
2k views

SHA-3 block sizes / bitrate calculation?

Looking into different papers and online documents, I find the following block sizes for SHA-3: SHA3-224: 1152 Bit SHA3-256: 1088 Bit SHA3-384: 832 Bit SHA3-512: 576 Bit Somehow I am unable to find (...
9
votes
1answer
736 views

Why does KangarooTwelve only use 12 rounds?

The initial Keccak submission used 18 rounds, which was bumped up to 24 rounds for the final version after distinguishers were found for a reduced 16 round variant. However, the Keccak team has ...
3
votes
2answers
935 views

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The output length of SHAKE128 and SHAKE256 is variable, but their strengths are still said ...
1
vote
1answer
279 views

SHA-3 Indexing Clarification for Theta() C[x,z]

SHA-3: http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf I’m working on a Python implementation of SHA-3(256) and using the intermediate hash value found at http://csrc.nist.gov/...
3
votes
1answer
652 views

Security of Keccak/SHA3 against birthday attacks

If I understand it correctly the security of $\operatorname{Keccak}$ depends on the capacity $c$, which means that I get a security level of $2^{128}$ for $c=128$ (I omitted the value $r$ here because ...
0
votes
0answers
663 views

Confusion about Padding of Keccak [duplicate]

I am doing a small research on the influence of the padding to the performance of sha3-256 and sha3-512. I read the padding rule in the NIST specification and then thought about a best and worst case ...
9
votes
2answers
2k views

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. so we have analyzed the NIST test vectors for SHA3, which states that append "0x06" (never used 1 followed by 'j'...
3
votes
2answers
608 views

What's the proper choice for the block size of a sponge-based hash?

While having a discussion about the future of Keccak in our library, we came to the discussion of how to properly assign a "block size" to Keccak (or more generally any sponge-based hash if possible), ...
0
votes
1answer
844 views

Crypto++ and SHA3 [closed]

I'm using c++ with the crypto++ library, which includes the keccak algorithm for hashing. I could find instances with specific length of the hashvalues. There are 224, 256, 384 and 512 bits. But I ...
2
votes
2answers
824 views

SHA-3 padding clarifications

I am implementing the SHA-3 algorithm in AVX2 assembly. The part where I am getting confused is that the padding with 10*1. Now my understanding is that the data message M first needs to be padded ...
1
vote
2answers
218 views

Why can't NORX produce intermediate auth tags like Keyak can?

Why can't NORX produce intermediate auth tags like Keyak can? Keyak appears quite attractive because of this, but seems to be slow in the absence of hardware acceleration.
1
vote
0answers
144 views

Can anyone tell whether this RHO step of SHA3 is correct?

In rho step of SHA3, I have done right circular rotation whether its correct ?? I am doing in Verilog so I am using concatenation operator for rotation. For x=0 and y=1 that is A[0][1] rotation will ...