Questions tagged [keccak]
SHA-3, originally known as Keccak, is a cryptographic hash function designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.
109
questions
2
votes
1
answer
30
views
Padding for SHAKE256
I have confusion regarding the padding for SHAKE256 that I am implementing.
Below are the snippets from FIPS 202
...
- 81
2
votes
0
answers
49
views
Source/derivation for incremental SHAKE function parameters
I was reading an open access paper on incremental hashing functions, which provides definitions for iSHAKE128 and iSHAKE256, respectively.
I understood the high-level concepts presented in the paper, ...
- 21
0
votes
0
answers
56
views
What is a generalized algorithm to find five $z$-bit words for the inverse of $\theta$ function in the Keccak-$f$ permutation?
This implementation of the inverse of the Keccak-$f$ permutation contains five 64-bit words (called “inversePositions64” in the code) for the inverse of $\theta$ function:
...
- 1,367
0
votes
2
answers
81
views
NIST Keccak test vectors confusion
I was looking at the test vectors of keccak provided by NIST here https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values and specifically for these example inputs of ...
- 1
0
votes
0
answers
74
views
Keccak implementation confusion
I am implementing a Keccak core in VHDL and I am currently almost done yet I am still facing some problems and would appreciate your insight.
First of all I wanna ask about the padding,
I know that we ...
- 1
0
votes
0
answers
106
views
Generating UUID from Keccak-256 hash
Is generating Keccak-256 hashes with timestamp + nonce (ensured to be unique for each run), and taking its most significant 16 bytes sufficient to generate random V4 UUIDs?
Obviously the 13th hex ...
- 101
0
votes
1
answer
107
views
KangarooTwelve based Random-Access PRNG
Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
- 1
3
votes
4
answers
307
views
How is the $\chi$ step of the Keccak permutation invertible?
I would like to understand how Keccak's permutation function is reversible. The difficulty I have is with the $\chi$ step that uses the and operator which is not revertible. All the other ...
- 33
1
vote
1
answer
131
views
In hardware, why using an algebraic implementation of a (small) S-Box instead of a LUT?
There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function.
The Chi function ...
- 11
1
vote
1
answer
109
views
Does information about known input&output for SHA3-256 help to find KECCAK-256 input for the same output?
I received two distinct outcomes from a single input using SHA3-256 and KECCAK-256:
input --> sha3-256 --> output1
input --> keccak-256 --> output2
...
- 11
4
votes
1
answer
120
views
Which ciphers have been defined that use the Keccak sponge?
There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized ...
- 93.9k
0
votes
1
answer
409
views
Keccak Capacity bits Parameter
I am learning Keccak Hash Algorithm and I am a little bit confused about the Capacity bits parameter. I am trying to understand how we can set the capacity parameters while implementing Keccak in ...
3
votes
1
answer
510
views
What's the problem with ECDSA and SHA-3?
To quote Ilari on the CFRG mailing list:
e.g. the vile mess that is ECDSA with SHA-3
I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
- 4,933
2
votes
0
answers
56
views
Is it possible to adapt Keccak to use 60-bit native words, without having to emulate U64?
Assume an architecture with fast 60-bit native words (a close example would be Ocaml, which has unboxed 63-bit numbers, and only boxed 64-bit numbers). We're looking for the fastest hash function in ...
- 1,365
1
vote
0
answers
51
views
What is the security of XORing SHAKE256_XOF with itself?
After reading "Can the xor of two RNG outputs ever be less secure than one of them?" I wondered if you can increase security of SHAKE256_XOF by using ...
- 175
6
votes
1
answer
634
views
Can you use SHAKE256_XOF with XOR to make a stream cipher?
SHAKE256_XOF is an extendable output function based on SHA3-512. SHAKE256_XOF can be used to create an infinite length bit string with 256-bits of security. For example:
...
- 175
1
vote
2
answers
90
views
If secret S is not known to an attacker, while constant K and SHA3(K + SHA3(S)) are known to an attacker, is S discoverable?
I'm trying to understand how secure S is from an attacker. Let's say in an instance where they have enormous hashing power available to them, as would be the case where they own cryptocurrency mining ...
- 111
1
vote
1
answer
80
views
What input bits are revealed when revealing the first 256 bits of the output Keccak-f permutation?
Given the Keccak-f[1600] permutation I am interested in the following property: What bits in the output are influenced by what bits of the input? That is, if I change for example say the second bit of ...
- 357
0
votes
1
answer
461
views
Selecting parameters for PBKDF2 using SHA3
I'm using PBKDF2 to generate an ED448 signing key, and I'm trying to figure out the optimal salt size for SHA-3.
I recall reading a recommendation to use a salt size equal to the PRF's internal-state ...
2
votes
0
answers
226
views
Clarification about the iota function of SHA-3
I am trying to implement SHA-3 using this document and have a question about the iota step.
This step consists in a single XOR between the central (0, 0) lane of the state (illustration of the state p....
- 186
4
votes
1
answer
2k
views
Is KMAC just SHA-3-256(KEY || message)
According to keccak strengths you have:
Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be ...
- 504
2
votes
0
answers
95
views
What are the differences between the various Authenticated Encryption schemes using Keccak?
Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption.
However, there already seem multiple schemes defined for it, including their own implementations:
...
- 93.9k
0
votes
0
answers
65
views
Using a bit sequence of zeros followed by one byte in Keccak
For what purpose it is not right to use a bit sequence of 2000+ zeros followed by one byte in Keccak? Is there a possible application of such input for Keccak? If yes, after which transformation?
- 1
3
votes
1
answer
227
views
Can a SHA3 engine be used to construct a Keccak implementation?
I am working on a cSHAKE-128 & cSHAKE-256 implementation that takes advantage of a number of hardware accelerators I have at my disposal, specifically for SHA-3 256/384/512 and SHAKE 128/256.
...
- 31
3
votes
1
answer
316
views
SHA3 hexadecimal paddig odd length string
Section B2 of FIPS-202 specification describes the Hexadecimal Form of Padding Bits which is basically the translation of the bit padding 0110*1. However at the beginning they suppose that the message ...
- 33
3
votes
2
answers
835
views
Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?
Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
- 93.9k
4
votes
2
answers
412
views
How does KECCAK operate on a state array filled with zeros?
Im trying to implement a sponge in Java. The state starts out as an empty 200 byte array of all zeros. In the KMAC samples document from NIST, the following happens:
(black line is a pdf page break)
...
4
votes
3
answers
353
views
Some questions on building permutations from boolean functions
I've seen multiple examples of boolean functions being used as a permutation.
For example the Keccak Chi : 2.3.1 function:
from https://keccak.team/figures.html
Or as a formula: for $i=\{0..4\}$ $A_i=...
- 71
1
vote
1
answer
263
views
Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?
I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case :
...
- 240
1
vote
2
answers
699
views
For data shorter than 32 bytes, is it sure that no collision exists?
I’m not talking about if a collision can be found but even simply exists.
The point is since it’s shorter than the length of the hash (since I’m talking about keccak256), normally there’s a hash ...
- 240
0
votes
1
answer
134
views
How to interpret a specific mathematical notation in "FIPS 202" (SHA-3 / Keccak)
tl;dr What does "d <= |Z|" mean in the context of bit array manipulations?
As a learning exercise I'm working on an implementation of SHA-3. I am not a cryptography specialist in any way but I ...
- 117
3
votes
1
answer
1k
views
What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?
Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
- 401
3
votes
0
answers
80
views
Small(er)-lane Keccak-f: impact and usage
Keccak defines a family of hash functions, by building a sponge out of a permutation Keccak-$f[b]: \{0,1\}^b \rightarrow \{0,1\}^b$. This permutation function is parametrised using $b$, which is the ...
- 2,430
0
votes
1
answer
124
views
What does the minimal number of round of "nr" use Keccak to avoid “collision attack”?
What does the minimal number of round of "nr" use Keccak to avoid collision attack?
$$nr = 12+2L$$
5
votes
1
answer
135
views
What are the uses of arbitrary length output hashes (other than OAEP)?
Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications.
I know that ...
- 6,502
3
votes
2
answers
260
views
What are the values of $w$ such that the corresponding $\text{Keccak-}f[25w]$ function is invertible (bijective)?
From this answer, I see that from a mathematical point of view, one could define the $\text{Keccak-}f[25w]$ permutation for an arbitrary value of $w$.
I am interested in the following question: ...
- 1,367
4
votes
1
answer
206
views
Is it reasonable to assume that $\text{Keccak-}f[25n]$ block permutation is defined for any value of $n$?
Wikipedia contains the following claim for $\text{Keccak-}f[25w]$:
It is defined for any power-of-two word size, $w = 2^ℓ$ bits.
Although all official descriptions of Keccak do not explicitly ...
- 1,367
2
votes
1
answer
213
views
Given a particular $1600$-bit output $Y$, is it feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?
I have read this answer on Crypto.SE and I want to clarify a few details.
Does this property of $\text{Keccak-}f[1600](x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible ...
- 1,367
2
votes
1
answer
386
views
Capacity bits in SHA-3
I am trying to understand the sponge construction, and in the official web site I found this sentence:
The last c bits of the state are never directly affected by the input blocks and are never ...
- 123
4
votes
2
answers
739
views
Intuition for SHA3 sponge construction
I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation.
Let's consider the case where we have don't apply $f$ in the squeezing ...
- 737
4
votes
1
answer
697
views
What does Keccak being "efficiently invertible" mean?
Reading through Wikipedia, I saw this:
It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge ...
user55672
0
votes
2
answers
1k
views
What is a permutation in Keccak?
I am trying to understand Ethereum's hash algorithm Keccak. Keccak uses permutations in the hashing process. Could anyone explain me what this permutation looks like or how it works ? I only know ...
- 103
2
votes
1
answer
850
views
Simplifying the description of the Keccak padding rules
I would like to check if my following understanding of Keccak padding has any flaws and if there are, please feel free to point them out and correct them.
The Keccak version I am interested is the ...
- 254
1
vote
1
answer
279
views
shake-128 in 32-bits platform
I am implementing shake in 32-bits microcontroller, so I would like to use bit interleaving.
I checked the code in: https://github.com/floodyberry/supercop/blob/master/crypto_hash/keccak/simple32bi/...
- 13
0
votes
1
answer
606
views
rotation offsets for KECCAK-$f$[800]
So let's say you're trying to do SHA3-224.
If you're on a 64-bit machine you'd presumably use KECCAK-$f$[1600]. In-so-far as I understand it'd have the following parameters:
Rate: 448 (2*224)
...
- 2,959
7
votes
2
answers
398
views
Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$
$\require{begingroup}\begingroup
\DeclareMathOperator{\keccak}{\mathrm{Keccak}}
\DeclareMathOperator{\concat}{\|}
$According to Keccak's website, $\keccak(k \concat x)$ is safe:
Unlike SHA-1 and ...
- 731
3
votes
1
answer
659
views
why was padding changed when keccak became sha3?
In the original Keccak you would pad by adding a 1 bit proceeded by a predetermined amount of 0 bits and then another 1 bit.
When Keccak was standardized to sha3 the padding was changed. It was then (...
- 2,959
1
vote
2
answers
554
views
Best way, how to convert 32-byte Keccak hashes to positive numbers up to maximum?
I have 32-byte Keccak hashes and I have some maximum number, for example 500, how to uniformly convert those hashes to pseudo-random positive numbers up to that ...
- 151
6
votes
1
answer
542
views
What is the size of codomain of a function $G(x) = F^A(x) \oplus F^B(x)$, where $F(x) = \text{Keccak-}f[1600](x)$?
Assuming that $m$ is a multiset of bitstrings where all bitstrings have the same length, let $D(m)$ denote the number of distinct elements in $m$. That is, $D(m)$ is equal to the dimension of $m$. For ...
- 1,367
3
votes
1
answer
245
views
Are there known special cases where the first 160 bits of keccak256 can be null ? Or does finding a collision is required?
In the Tronix contract code (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers :
...
- 240