# Questions tagged [keccak]

SHA-3, originally known as Keccak, is a cryptographic hash function designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.

78 questions
43 views

### What does the minimal number of round of “nr” use Keccak to avoid “collision attack”?

What does the minimal number of round of "nr" use Keccak to avoid collision attack? $$nr = 12+2L$$
75 views

### What are the uses of arbitrary length output hashes (other than OAEP)?

Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications. I know that ...
172 views

### What are the values of $w$ such that the corresponding $\text{Keccak-}f[25w]$ function is invertible (bijective)?

From this answer, I see that from a mathematical point of view, one could define the $\text{Keccak-}f[25w]$ permutation for an arbitrary value of $w$. I am interested in the following question: ...
102 views

### Is it reasonable to assume that $\text{Keccak-}f[25n]$ block permutation is defined for any value of $n$?

Wikipedia contains the following claim for $\text{Keccak-}f[25w]$: It is defined for any power-of-two word size, $w = 2^ℓ$ bits. Although all official descriptions of Keccak do not explicitly ...
104 views

### Given a particular $1600$-bit output $Y$, is it feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f(X) = Y$?

I have read this answer on Crypto.SE and I want to clarify a few details. Does this property of $\text{Keccak-}f(x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible ...
68 views

### Capacity bits in SHA-3

I am trying to understand the sponge construction, and in the official web site I found this sentence: The last c bits of the state are never directly affected by the input blocks and are never ...
174 views

### Intuition for SHA3 sponge construction

I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation. Let's consider the case where we have don't apply $f$ in the squeezing ...
141 views

### What does Keccak being “efficiently invertible” mean?

Reading through Wikipedia, I saw this: It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge ...
77 views

### What is a permutation in Keccak?

I am trying to understand Ethereum's hash algorithm Keccak. Keccak uses permutations in the hashing process. Could anyone explain me what this permutation looks like or how it works ? I only know ...
36 views

### Simplifying the description of the Keccak padding rules

I would like to check if my following understanding of Keccak padding has any flaws and if there are, please feel free to point them out and correct them. The Keccak version I am interested is the ...
60 views

### shake-128 in 32-bits platform

I am implementing shake in 32-bits microcontroller, so I would like to use bit interleaving. I checked the code in: https://github.com/floodyberry/supercop/blob/master/crypto_hash/keccak/simple32bi/...
133 views

### rotation offsets for KECCAK-$f$

So let's say you're trying to do SHA3-224. If you're on a 64-bit machine you'd presumably use KECCAK-$f$. In-so-far as I understand it'd have the following parameters: Rate: 448 (2*224) ...
192 views

### Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

$\require{begingroup}\begingroup \DeclareMathOperator{\keccak}{\mathrm{Keccak}} \DeclareMathOperator{\concat}{\|}$According to Keccak's website, $\keccak(k \concat x)$ is safe: Unlike SHA-1 and ...
134 views

### why was padding changed when keccak became sha3?

In the original Keccak you would pad by adding a 1 bit proceeded by a predetermined amount of 0 bits and then another 1 bit. When Keccak was standardized to sha3 the padding was changed. It was then (...
186 views

### Best way, how to convert 32-byte Keccak hashes to positive numbers up to maximum?

I have 32-byte Keccak hashes and I have some maximum number, for example 500, how to uniformly convert those hashes to pseudo-random positive numbers up to that ...
422 views

### What is the size of codomain of a function $G(x) = F^A(x) \oplus F^B(x)$, where $F(x) = \text{Keccak-}f(x)$?

Assuming that $m$ is a multiset of bitstrings where all bitstrings have the same length, let $D(m)$ denote the number of distinct elements in $m$. That is, $D(m)$ is equal to the dimension of $m$. For ...
61 views

### Are there known special cases where the first 160 bits of keccak256 can be null ? Or does finding a collision is required?

In the Tronix contract code (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers : ...
117 views

### What are the consequences if someone finds the accessible 1600-bit block $X$ and $R$-bit block $V$ such that $\text{Keccak-}f(X \oplus V) = X$?

Let $H$ denote any hash function based on the sponge construction. Let $F$ denote its underlying function that transforms the $L$-bit state (for SHA-3, $F = \text{Keccak-}f$ ). Let $R$ denote ...
308 views

### Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
304 views

### Security of XORing hashes vs concatenating

On this question https://stackoverflow.com/questions/5889238/why-is-xor-the-default-way-to-combine-hashes a couple of the answers say that xoring is a bad/insecure choice for combining hashes. However,...
64 views

### Identify Keccak Algorithm

I need to analyse a binary code and check if Keccak is used in this code. I can identify AES, by using Rijndael S-box. Is there a similiar box for Keccak?
143 views

### Closest Keccak256 hashes by Hamming distance? [closed]

What are the two "closest" known Keccak256 (not SHA-3 256) hashes in terms of the Hamming distance between the pair of hashes? EDIT: This was marked as opinion based, so to clarify, when I asked this ...
258 views

### SHA3 hardware implementation [closed]

I am studying SHA3 in order to create a hardware implementation, preferably in verilog. I have downloaded VHDL reference implementation from https://keccak.team/hardware.html. The code is great, and ...
248 views

### 0.75 confidence in bit prediction through $\chi^{-1}$

When checking the S-Box implementation of $\chi$ in Keccak I wanted to see if there were any fixed bits in the forward direction of $\chi$ that could be leverage to reveal truncated state bits. I ...
140 views

### How would Keccak attain a 512-bit security level?

I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that. ...
4k views

### Why is SHA-3 a Sponge function?

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
153 views

### Strength of Hash obtained by XOR of parts of SHA3

I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail has the last 64 bits. Next, I XOR head and tail. Which ...
737 views

### Use sha3 for passwords hashing

Is use of sha3 justifiable? Is sha3 better than sha2 in (m)any aspects? P.S. I want to use hashing for passwords in a database
406 views

### Using Keccak permutation as a block cipher

The inverse of Keccak is slow, but if you have a problem where that is not a concern would this be a secure cipher? The encryption function can be made incredibly fast in hardware. Or the reverse if ...
320 views

### What is an extendable output function?

The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
263 views

### Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
196 views

### Correct integer input value for keccak 256 [closed]

Assuming that we use k = sha3.keccak_256()(pysha3 package). How should one convert integer input for a function ...
605 views

### What is the current time limit of Keccak inversion? [closed]

All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this ...
93 views

### What are the properties of a function based on multiple iterations of a pseudo-random permutation?

Let $F(S) = \text{Keccak-}f(S)$. Assuming that the length of $S$ is equal to $1600 \times k$ and if $k$ is greater than $1$, we define a function $F_{k}(S)$ as follows. We note that $S$ is ...
111 views

### What is the expected number of different sequences of bits in the collection that contains $2^{800}$ elements?

Let $F$ denote a function that returns the first $800$ bits of the input. Let $G(N)$ denote a function that returns the last $800$ bits of the binary encoding of the given number $N$. For example, ...
108 views

### Is the Keccak family of sponge constructions the same as SHA-3?

I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as ...
123 views

### Is it theoretically possible for the output of SHAKE to be an infinite concatenation of the same 512-bit block?

Let $X$ denote a particular 512-bit sequence. Let $A,B,C$ denote sequences of bits such that: $$len(X || A) = len(X || B) = len(X || C) = 1600$$ $$\operatorname{Keccak-}f(X||A) = X||B$$ \...
132 views

### Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
171 views

### Reasoning behind SHA-3 state array indexing

I was reading through the SHA3 standard (https://dx.doi.org/10.6028/NIST.FIPS.202) and in the standard it defines how to construct 3D state array from a 1D array. The state array is defined as ...
388 views

### Shake 128/256 Output Length Restrictions

Are there any restrictions on the specified output length when using shake-128 or shake-256, to the extent that certain output lengths should be avoided/or not used entirely? Edit: If someone ...
304 views

### Why is Keccak-f reversible? [duplicate]

It seems like the Keccak permutation is reversible, which is not making the output of SHAKE forward-secure. In the sense that if one state is leaked, everything can be recovered. I wanted to know the ...
2k views

### SHA-3 block sizes / bitrate calculation?

Looking into different papers and online documents, I find the following block sizes for SHA-3: SHA3-224: 1152 Bit SHA3-256: 1088 Bit SHA3-384: 832 Bit SHA3-512: 576 Bit Somehow I am unable to find (...
776 views

### Why does KangarooTwelve only use 12 rounds?

The initial Keccak submission used 18 rounds, which was bumped up to 24 rounds for the final version after distinguishers were found for a reduced 16 round variant. However, the Keccak team has ...
1k views

### If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The output length of SHAKE128 and SHAKE256 is variable, but their strengths are still said ...
301 views

### SHA-3 Indexing Clarification for Theta() C[x,z]

SHA-3: http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf I’m working on a Python implementation of SHA-3(256) and using the intermediate hash value found at http://csrc.nist.gov/...
687 views

### Security of Keccak/SHA3 against birthday attacks

If I understand it correctly the security of $\operatorname{Keccak}$ depends on the capacity $c$, which means that I get a security level of $2^{128}$ for $c=128$ (I omitted the value $r$ here because ...
694 views

### Confusion about Padding of Keccak [duplicate]

I am doing a small research on the influence of the padding to the performance of sha3-256 and sha3-512. I read the padding rule in the NIST specification and then thought about a best and worst case ...
2k views

### Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. so we have analyzed the NIST test vectors for SHA3, which states that append "0x06" (never used 1 followed by 'j'...