Questions tagged [sha-3]
SHA-3, also known as Keccak, is a cryptographic hash function standardized by NIST as a new alternative to the SHA-2 hash function family.
0
votes
1answer
74 views
Computational Complexity of SHA-3 (SHAKE128)
Please, I got the question "what is the computational complexity of SHA-3 (SHAKE128)"?
What does that mean and how can I calculate that??
*I am using SHA-3 (SHAKE128) in my mechanism to hash fix ...
3
votes
2answers
147 views
Intuition for SHA3 sponge construction
I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation.
Let's consider the case where we have don't apply $f$ in the squeezing ...
0
votes
1answer
55 views
How long would it take to crack a double hash if salt and final hash are public?
I have a hash of a file $H_1$ and then I add salt and rehash it: $H_2$. I make my $H_2$ and salt public and I use my $H_1$ as a password. How long would it take for this to be cracked with someone ...
3
votes
1answer
119 views
What does Keccak being “efficiently invertible” mean?
Reading through Wikipedia, I saw this:
It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge ...
19
votes
1answer
3k views
Why is SHA-3 robust against Length-Extension Attacks?
If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
0
votes
1answer
99 views
rotation offsets for KECCAK-$f$[800]
So let's say you're trying to do SHA3-224.
If you're on a 64-bit machine you'd presumably use KECCAK-$f$[1600]. In-so-far as I understand it'd have the following parameters:
Rate: 448 (2*224)
...
3
votes
1answer
93 views
why was padding changed when keccak became sha3?
In the original Keccak you would pad by adding a 1 bit proceeded by a predetermined amount of 0 bits and then another 1 bit.
When Keccak was standardized to sha3 the padding was changed. It was then (...
1
vote
2answers
166 views
mapping a 256 bit random number to a 3 bit number
I am making a 2 player dice game that runs for n rounds. To create random dice roles im using a concept a understood from randao.
each user generates n sha3 hashes recursively of a random seed : e.g. ...
4
votes
2answers
290 views
Benchmark (hash rate) for SHA-3 (SHAKE128)
To estimate the time for brute-force attack we need to compute keyspace size divided by hash rate, where the hash rate (hash/second) varies depending on the computer's capabilities.
The website https:...
0
votes
1answer
102 views
Benchmark for SHA-3 (Shake128) [duplicate]
I am trying to find the average of hash rate (benchmark) for SHA-3(Shake128) for a normal and supercomputer in order to estimate the brute-force attack which I can get if from ( keyspace / hash rate )....
4
votes
1answer
210 views
How secure is using a hash function as Key Derivation Function?
I am developing a personal project and I have the following need:
given a randomly generated seed (with enough entropy) I need to generate a number $x$ of Ed25519 key pairs.
These key pairs are not ...
1
vote
0answers
42 views
Hash Function SHA-3 [duplicate]
I would like to discuss the minimum input of hash function to consider strong (e.g Shack128 (SHA-3)). I have a mechanism based on SHA-3, but the input is just 40-bit, some friends told me 40-bit input ...
2
votes
0answers
187 views
SHA3 hardware implementation [closed]
I am studying SHA3 in order to create a hardware implementation, preferably in verilog. I have downloaded VHDL reference implementation from https://keccak.team/hardware.html.
The code is great, and ...
0
votes
1answer
241 views
0.75 confidence in bit prediction through $\chi^{-1}$
When checking the S-Box implementation of $\chi$ in Keccak I wanted to see if there were any fixed bits in the forward direction of $\chi$ that could be leverage to reveal truncated state bits.
I ...
1
vote
1answer
302 views
Will the ECDSA with SHA-3 implementation be quantum-proof?
I know, that ECDSA could be broken by quantum computers, but since there is post-quantum hash function SHA-3, does not this make the digital signature resistant to them?
8
votes
2answers
2k views
Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?
Why is SHA-3 prefixed with “SHA” despite the fact that it is structurally different from SHA-2 and SHA-1?
SHA-0, 1 & 2 and MD5 is based on Merkle–Damgård construction, while SHA-3 falls under ...
3
votes
2answers
421 views
Is it secure to hash an AES key?
Let's say I want a way of generating a deterministic public ID for a specific symmetric cryptographic key (AES, for example). Would it be secure to use SHA-3 (or SHAKE) to hash the key, and then ...
0
votes
0answers
97 views
How would Keccak-1024
I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that.
...
11
votes
2answers
3k views
Why is SHA-3 a Sponge function?
A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
4
votes
1answer
131 views
Strength of Hash obtained by XOR of parts of SHA3
I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail has the last 64 bits.
Next, I XOR head and tail. Which ...
-4
votes
1answer
154 views
Hexadecimal and ASCII give different SHA3 hashes, why?
Hex and ASCII are encoded with the same binary code. Why is it that a message in ASCII and the same message in hexadecimal produce different hashes?
For example, the message ...
1
vote
1answer
536 views
Use sha3 for passwords hashing
Is use of sha3 justifiable? Is sha3 better than sha2 in (m)any aspects?
P.S. I want to use hashing for passwords in a database
0
votes
0answers
42 views
XOF Hash Algorithm with Avalanche on Length Change
I have been looking at XOF hash algorithms; specifically (or at least the only ones I know to exist) SHAKE128 and SHAKE256.
...
1
vote
1answer
119 views
What does this part of the SHA-3 algorithm mean?
I was reading through this paper and came across (pg. 11 of PDF, 5 of paper) the right_encode(x) and left_encode(x) pseudo-code ...
3
votes
1answer
227 views
What is an extendable output function?
The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
0
votes
1answer
241 views
Cache Timing Attack SHA-3
I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
1
vote
0answers
65 views
Is there any cipher standard based on SHA-3, where it is not used as part of RFC2104?
I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this:
IV|AES-CTR(PLAINTEXT_SIZE|PLAINTEXT|SHA-3(KEY|PLAINTEXT_SIZE|PLAINTEXT))
So, ...
0
votes
1answer
162 views
Correct integer input value for keccak 256 [closed]
Assuming that we use k = sha3.keccak_256()(pysha3 package).
How should one convert integer input for a function ...
4
votes
3answers
570 views
What is the current time limit of Keccak inversion? [closed]
All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this ...
3
votes
0answers
92 views
What is the expected number of different sequences of bits in the collection that contains $2^{800}$ elements?
Let $F$ denote a function that returns the first $800$ bits of the input.
Let $G(N)$ denote a function that returns the last $800$ bits of the binary encoding of the given number $N$. For example, ...
4
votes
1answer
117 views
Is it theoretically possible for the output of SHAKE to be an infinite concatenation of the same 512-bit block?
Let $X$ denote a particular 512-bit sequence.
Let $A,B,C$ denote sequences of bits such that:
$$len(X || A) = len(X || B) = len(X || C) = 1600$$
$$\operatorname{Keccak-}f(X||A) = X||B$$
$$\...
3
votes
1answer
157 views
Reasoning behind SHA-3 state array indexing
I was reading through the SHA3 standard (https://dx.doi.org/10.6028/NIST.FIPS.202) and in the standard it defines how to construct 3D state array from a 1D array.
The state array is defined as ...
1
vote
1answer
329 views
Shake 128/256 Output Length Restrictions
Are there any restrictions on the specified output length when using shake-128 or shake-256, to the extent that certain output lengths should be avoided/or not used entirely?
Edit:
If someone ...
1
vote
0answers
114 views
does SHA* collide more or less than a random function?
There were several questions here regarding how surjective SHA-1/2 is, how many values don't have a pre-image from a fixed size input. I and others answered when modelling the relevant hash function ...
8
votes
1answer
821 views
Free Start Collision In SHA-3
Given that the five sub-functions that comprise SHA-3 are reversible an individual can produce specific outputs of their choosing. The following is to my knowledge an example of a free start collision ...
6
votes
2answers
2k views
SHA-3 block sizes / bitrate calculation?
Looking into different papers and online documents, I find the following block sizes for SHA-3:
SHA3-224: 1152 Bit
SHA3-256: 1088 Bit
SHA3-384: 832 Bit
SHA3-512: 576 Bit
Somehow I am unable to find (...
2
votes
1answer
342 views
SHA3 HMAC key padding
According to the pseudocode, keys longer than the block-size of the underlying hash function are shortened by hashing the key. Furthermore, keys shorter than the blocksize are zero-padded up the ...
10
votes
1answer
527 views
Is hashing large files CPU or I/O bound?
For SHA3, if I were to hash large files (> 1GB), would that operation be CPU or I/O bound?
Suppose I were to exploit parallelism and either use multicore/SIMD execution or generate a hash tree, ...
1
vote
2answers
737 views
Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?
I know that sponge functions are different in many ways. Yet I'd like to know if SHA-3 can nonetheless be said to be "based", if not simply "inspired", by the Merkle-Damgård construction. To be more ...
1
vote
1answer
539 views
Questions about SHA and SHAKE [duplicate]
So I got bored one weekend so I thought I would make a login system in python. I then realized if I wanted to reuse the accounts I made I had to store the account details locally. I realized I had to ...
7
votes
1answer
345 views
Is there a quick way to know the length of a message hashed using SHA3?
Let M be the message that has been padded for use into the SHA3 (standardized Keccak) hash function.
Is there a way, like it's the case for SHA1, to know the total length of the message M just by ...
0
votes
2answers
337 views
Is it possible to have a bit oriented inversion of SHA-3's theta() function?
I've been working on developing alternative documentation for the sub-function chi() in SHA-3. My main question (Expanded below): Can the method I used for chi() can be applied to the function theta()?...
3
votes
2answers
879 views
If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?
The general idea is that the security strength of a good hash function is equal to half it's output length. The output length of SHAKE128 and SHAKE256 is variable, but their strengths are still said ...
1
vote
2answers
193 views
Hashing Algorithm Integrity Validation
I am developing an application that will need to store a very large volume of hashed data per user for which I want to ensure I am doing everything possible to maximize security. At this point I ...
7
votes
2answers
165 views
FIPS 202/SHAKE: insecure 3DES key derivation example
I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
2
votes
1answer
532 views
SHA-3 Sub-Function Reversibility Clarification
SHA-3 Sub-Function Reversibility Clarification
I just finished a very slow and clunky python implementation of SHA-3 (224,256,384,512). The exercise was not designed for speed. My only objective ...
1
vote
1answer
270 views
SHA-3 Indexing Clarification for Theta() C[x,z]
SHA-3:
http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf
I’m working on a Python implementation of SHA-3(256) and using the intermediate hash value found at http://csrc.nist.gov/...
4
votes
1answer
122 views
How are hash functions analyzed in an open competition?
There was a well-known SHA-3 Competition held between 2007 and 2012, where the winner would be standardized as SHA-3. Now that the competition has ended and NIST has released reports on the different ...
3
votes
1answer
629 views
Security of Keccak/SHA3 against birthday attacks
If I understand it correctly the security of $\operatorname{Keccak}$ depends on the capacity $c$, which means that I get a security level of $2^{128}$ for $c=128$ (I omitted the value $r$ here because ...
0
votes
0answers
652 views
Confusion about Padding of Keccak [duplicate]
I am doing a small research on the influence of the padding to the performance of sha3-256 and sha3-512.
I read the padding rule in the NIST specification and then thought about a best and worst case ...
