Questions tagged [sha-3]

SHA-3, also known as Keccak, is a cryptographic hash function standardized by NIST as a new alternative to the SHA-2 hash function family.

Filter by
Sorted by
Tagged with
35 votes
5 answers
6k views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
Nakedible's user avatar
  • 1,440
26 votes
2 answers
7k views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
hl3mukkel's user avatar
  • 499
18 votes
2 answers
7k views

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
Hauleth's user avatar
  • 316
30 votes
1 answer
4k views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
fgrieu's user avatar
  • 140k
13 votes
2 answers
7k views

SHAKE-128/256 or SHA3-256/512

Would it be better to use SHAKE-128/256 or SHA3-256/512? In what situation should I chose one over the other?
Alejandro Martinez's user avatar
9 votes
3 answers
1k views

What criteria make the theta step of Keccak's round function reversible?

From what I've been reading, Keccak's round function is reversible. That's pretty obvious for the $\rho$, $\pi$ and $\iota$ transforms. For $\chi$ to be reversible, $x$'s range has to be odd — but ...
e-sushi's user avatar
  • 17.9k
4 votes
2 answers
2k views

Benchmark (hash rate) for SHA-3 (SHAKE128)

To estimate the time for brute-force attack we need to compute keyspace size divided by hash rate, where the hash rate (hash/second) varies depending on the computer's capabilities. The website https:...
Al-Ani's user avatar
  • 95
18 votes
1 answer
6k views

What are the key differences between the draft SHA-3 standard and the Keccak submission?

I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014). Previously it ...
Paŭlo Ebermann's user avatar
11 votes
1 answer
2k views

Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
Cryptographeur's user avatar
9 votes
3 answers
6k views

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. so we have analyzed the NIST test vectors for SHA3, which states that append "0x06" (never used 1 followed by 'j'...
Vani's user avatar
  • 91
3 votes
1 answer
392 views

Why HAIFA and sponge constructions are not prone to length extension attacks?

I was writing in a document about the flaws of the MD construction which pushed cryptographers to create different and more robust constructions. However, I don't know why HAIFA and Sponge ...
Hinton Zsh's user avatar
34 votes
1 answer
6k views

Proof for the SHA3 claim that 256 bit security is "post-quantum sufficient"?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → {25,50,100,200,400,800,...
e-sushi's user avatar
  • 17.9k
24 votes
3 answers
3k views

Are NIST's changes to Keccak/SHA-3 problematic?

NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as SHA-...
D.W.'s user avatar
  • 36.3k
11 votes
2 answers
4k views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
Maarten Bodewes's user avatar
  • 92.4k
8 votes
1 answer
2k views

Keccak padding implementation, and bit ordering

I am trying to implement Keccak in Java for my school work. And I am getting stuck in two places: On the summary page the padding is shown as P = M || 0x01 || 0x00 || … || 0x00 P = P xor (0x00 |...
Soham's user avatar
  • 255
8 votes
2 answers
5k views

SHA-3 block sizes / bitrate calculation?

Looking into different papers and online documents, I find the following block sizes for SHA-3: SHA3-224: 1152 Bit SHA3-256: 1088 Bit SHA3-384: 832 Bit SHA3-512: 576 Bit Somehow I am unable to find (...
Dennis's user avatar
  • 183
5 votes
1 answer
867 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
Maarten Bodewes's user avatar
  • 92.4k
5 votes
2 answers
3k views

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The output length of SHAKE128 and SHAKE256 is variable, but their strengths are still said ...
Melab's user avatar
  • 3,645
3 votes
1 answer
1k views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
user13183's user avatar
  • 145
2 votes
2 answers
1k views

SHA-3 Sub-Function Reversibility Clarification

SHA-3 Sub-Function Reversibility Clarification I just finished a very slow and clunky python implementation of SHA-3 (224,256,384,512). The exercise was not designed for speed. My only objective ...
Q-Club's user avatar
  • 1
1 vote
1 answer
385 views

Benchmark for SHA-3 (Shake128) [duplicate]

I am trying to find the average of hash rate (benchmark) for SHA-3(Shake128) for a normal and supercomputer in order to estimate the brute-force attack which I can get if from ( keyspace / hash rate )....
Al-Ani's user avatar
  • 95
1 vote
2 answers
207 views

SHA3 224 bit oriented mode and padding

I am looking for an example of handling bit messages in SHA-3. I have looked at the example for 5-bit here but when I give complete padded msg ...
Umadevi Palathur's user avatar
58 votes
4 answers
19k views

Why isn’t SHA-3 in wider use?

SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
RixN's user avatar
  • 772
58 votes
2 answers
20k views

What advantages does Keccak/SHA-3 have over BLAKE2?

Keccak/SHA-3 is new NIST standard for cryptographic hash functions. However, it is much slower than BLAKE2 in software implementations. Does Keccak have compensating advantages?
Demi's user avatar
  • 4,793
31 votes
1 answer
2k views

Is it possible to actually verify a “sponge function” security claim?

When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
e-sushi's user avatar
  • 17.9k
17 votes
2 answers
3k views

Why are the constants so simple in Keccak?

Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF) The initial values of the state in Keccak is ...
u0b34a0f6ae's user avatar
16 votes
1 answer
8k views

Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? I am trying to find them in the original Keccak documentation but can't find them. Is it some special mode of Keccak referenced in the documentation? ...
kimi's user avatar
  • 193
12 votes
1 answer
1k views

Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
sellibitze's user avatar
10 votes
2 answers
5k views

What is the sponge construction in simple terms?

I suggested to my client to use SHA3 instead of SHA2. I know that SHA3 is based on Keccak algorithm which won the NIST's competition. I want to explain the structure of sponge functions in very simple ...
Sam Claro's user avatar
  • 101
8 votes
2 answers
2k views

Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

Why is SHA-3 prefixed with “SHA” despite the fact that it is structurally different from SHA-2 and SHA-1? SHA-0, 1 & 2 and MD5 is based on Merkle–Damgård construction, while SHA-3 falls under ...
Nathan Aw's user avatar
  • 2,267
7 votes
2 answers
592 views

Will a SHAKE128 stream cipher be vulnerable to related key attacks?

Suppose that SHAKE is seeded with key concatenated to an IV, will the 'key' stream produced by SHAKE128 vulnerable to related key attacks like RC4 is? My guess is no because seed is already "...
DannyNiu's user avatar
  • 9,080
6 votes
1 answer
2k views

Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?

I'm trying to learn about sponge function for creating hash functions and generic attacks on it. I'm looking for the collision finding attack scenario which leads to $O(\min(2^{-n/2} , 2^{-c/2}))$ ...
Shnd's user avatar
  • 485
6 votes
2 answers
406 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
Luis Casillas's user avatar
4 votes
1 answer
1k views

Is KMAC just SHA-3-256(KEY || message)

According to keccak strengths you have: Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be ...
Finlay Weber's user avatar
4 votes
1 answer
1k views

What is the current time limit of Keccak inversion? [closed]

All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this ...
Q-Club's user avatar
  • 1
4 votes
1 answer
655 views

What does Keccak being "efficiently invertible" mean?

Reading through Wikipedia, I saw this: It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge ...
OverclockedSanic's user avatar
4 votes
1 answer
190 views

Is it theoretically possible for the output of SHAKE to be an infinite concatenation of the same 512-bit block?

Let $X$ denote a particular 512-bit sequence. Let $A,B,C$ denote sequences of bits such that: $$len(X || A) = len(X || B) = len(X || C) = 1600$$ $$\operatorname{Keccak-}f(X||A) = X||B$$ $$\...
lyrically wicked's user avatar
3 votes
2 answers
2k views

Replacing the PRF in PBKDF2 with Keccak

I am unable to find a reliable, tested library for a decent password based key derivation function e.g. Scrypt in the programming language I am using, but I have a reliable library for PBKDF2 (which ...
504811E's user avatar
  • 41
3 votes
2 answers
2k views

SHA-3 maximal number of zeros (Padding)

What is the maximum number of zeros, which are appended at the input- padding in messages? How large must the message be for this?
userkir's user avatar
  • 393
3 votes
1 answer
252 views

SHA3 hexadecimal paddig odd length string

Section B2 of FIPS-202 specification describes the Hexadecimal Form of Padding Bits which is basically the translation of the bit padding 0110*1. However at the beginning they suppose that the message ...
IAmUser's user avatar
  • 33
3 votes
2 answers
737 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
Maarten Bodewes's user avatar
  • 92.4k
3 votes
1 answer
205 views

Can a SHA3 engine be used to construct a Keccak implementation?

I am working on a cSHAKE-128 & cSHAKE-256 implementation that takes advantage of a number of hardware accelerators I have at my disposal, specifically for SHA-3 256/384/512 and SHAKE 128/256. ...
ismarlowe's user avatar
3 votes
1 answer
733 views

Where do the constants for SHA-1/2/3 come from?

My request is: I need to know the source of constants (shift constants, IV, or S-Box) for the following algorithms: SHA-1 SHA-2 (all sizes) SHA-3 Examples: BLOWFISH uses the hexadecimal ...
m.nasim's user avatar
  • 105
3 votes
2 answers
2k views

SHA-3 padding clarifications

I am implementing the SHA-3 algorithm in AVX2 assembly. The part where I am getting confused is that the padding with 10*1. Now my understanding is that the data message M first needs to be padded ...
quasar66's user avatar
  • 175
3 votes
1 answer
478 views

What's the problem with ECDSA and SHA-3?

To quote Ilari on the CFRG mailing list: e.g. the vile mess that is ECDSA with SHA-3 I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
Elias's user avatar
  • 4,903
2 votes
2 answers
391 views

Why is the output size exactly half the capacity for sha-3?

For the SHA-3 family of hash functions, the output size $d$ is always chosen as $d=c/2$, i.e. exactly half the capcity. What is the rational for this? Naively, I think that $d=c$ would make more sense ...
Simon's user avatar
  • 123
1 vote
2 answers
166 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
Zola Gonano's user avatar
1 vote
0 answers
50 views

Hash Function SHA-3 [duplicate]

I would like to discuss the minimum input of hash function to consider strong (e.g Shack128 (SHA-3)). I have a mechanism based on SHA-3, but the input is just 40-bit, some friends told me 40-bit input ...
Al-Ani's user avatar
  • 95
1 vote
2 answers
846 views

mapping a 256 bit random number to a 3 bit number

I am making a 2 player dice game that runs for n rounds. To create random dice roles im using a concept a understood from randao. each user generates n sha3 hashes recursively of a random seed : e.g. ...
user462003's user avatar
1 vote
1 answer
9k views

Advantages/Disadvantages of Bcrypt vs. hash/salt

I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people ...
biw's user avatar
  • 195