Skip to main content

Questions tagged [sha-3]

SHA-3, also known as Keccak, is a cryptographic hash function standardized by NIST as a new alternative to the SHA-2 hash function family.

Filter by
Sorted by
Tagged with
59 votes
4 answers
19k views

Why isn’t SHA-3 in wider use?

SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
RixN's user avatar
  • 782
58 votes
2 answers
21k views

What advantages does Keccak/SHA-3 have over BLAKE2?

Keccak/SHA-3 is new NIST standard for cryptographic hash functions. However, it is much slower than BLAKE2 in software implementations. Does Keccak have compensating advantages?
Demi's user avatar
  • 4,793
38 votes
2 answers
68k views

What is the difference between SHA-3 and SHA-256?

I am new about cryptography, I learned that SHA-3 (Secure Hash Algorithm 3) is the latest member of the Secure Hash Algorithm family of standards, released by NIST....
Ced's user avatar
  • 515
35 votes
5 answers
6k views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
Nakedible's user avatar
  • 1,440
34 votes
1 answer
6k views

Proof for the SHA3 claim that 256 bit security is "post-quantum sufficient"?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → {25,50,100,200,400,800,...
e-sushi's user avatar
  • 17.9k
31 votes
1 answer
2k views

Is it possible to actually verify a “sponge function” security claim?

When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
e-sushi's user avatar
  • 17.9k
30 votes
1 answer
4k views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
fgrieu's user avatar
  • 141k
26 votes
2 answers
7k views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
hl3mukkel's user avatar
  • 499
25 votes
1 answer
5k views

Why is SHA-3 robust against Length-Extension Attacks?

If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
elberman's user avatar
  • 351
24 votes
3 answers
3k views

Are NIST's changes to Keccak/SHA-3 problematic?

NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as SHA-...
D.W.'s user avatar
  • 36.4k
23 votes
1 answer
3k views

What is the origin of the word "Keccak"?

Where does the word or acronym Keccak come from? Guido Bertoni, Joan Daemen, Michael Peeters, and Gilles Van Assche. Keccak sponge function family main document. Submission to NIST (updated), 2009. "...
user8131's user avatar
  • 231
19 votes
2 answers
7k views

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
Hauleth's user avatar
  • 326
18 votes
1 answer
2k views

Did NIST verify “post-quantum” claims in the SHA3 proposal papers?

I have been reading Bernstein’s “Quantum attacks against Blue Midnight Wish, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Shabal, SHAvite-3, SIMD, and Skein” paper from 2010… This document disproves the ...
e-sushi's user avatar
  • 17.9k
18 votes
1 answer
6k views

What are the key differences between the draft SHA-3 standard and the Keccak submission?

I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014). Previously it ...
Paŭlo Ebermann's user avatar
17 votes
2 answers
3k views

Why are the constants so simple in Keccak?

Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF) The initial values of the state in Keccak is ...
u0b34a0f6ae's user avatar
16 votes
1 answer
8k views

Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? I am trying to find them in the original Keccak documentation but can't find them. Is it some special mode of Keccak referenced in the documentation? ...
kimi's user avatar
  • 193
14 votes
5 answers
9k views

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

My friend in the software industry came to me with one of his "dumb boss" war stories. This particular time, his (non-technical but eager to learn) manager came to him and told him to, in ...
squinged's user avatar
  • 143
13 votes
2 answers
8k views

SHAKE-128/256 or SHA3-256/512

Would it be better to use SHAKE-128/256 or SHA3-256/512? In what situation should I chose one over the other?
Alejandro Martinez's user avatar
12 votes
3 answers
11k views

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5. Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered ...
prakharjain's user avatar
12 votes
2 answers
4k views

Why is SHA-3 a Sponge function?

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
user56848's user avatar
  • 121
12 votes
3 answers
3k views

SHA3-255, one bit less

I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also ...
ragazzojp's user avatar
  • 413
12 votes
1 answer
1k views

Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
sellibitze's user avatar
11 votes
2 answers
4k views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
Maarten Bodewes's user avatar
  • 92.7k
11 votes
1 answer
2k views

Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
Cryptographeur's user avatar
10 votes
3 answers
7k views

Why is SHA3 more secure than SHA2?

Why are SHA3 algorithms considered more secure than their SHA2 counterparts? Surely in part, it is due to their resistance to length extension attacks. But specifically, when considering collision ...
Arturo Roman's user avatar
10 votes
2 answers
5k views

What is the sponge construction in simple terms?

I suggested to my client to use SHA3 instead of SHA2. I know that SHA3 is based on Keccak algorithm which won the NIST's competition. I want to explain the structure of sponge functions in very simple ...
Sam Claro's user avatar
  • 101
10 votes
3 answers
1k views

What criteria make the theta step of Keccak's round function reversible?

From what I've been reading, Keccak's round function is reversible. That's pretty obvious for the $\rho$, $\pi$ and $\iota$ transforms. For $\chi$ to be reversible, $x$'s range has to be odd — but ...
e-sushi's user avatar
  • 17.9k
10 votes
1 answer
2k views

What is an extendable output function?

The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
Melab's user avatar
  • 3,655
10 votes
1 answer
2k views

Is hashing large files CPU or I/O bound?

For SHA3, if I were to hash large files (> 1GB), would that operation be CPU or I/O bound? Suppose I were to exploit parallelism and either use multicore/SIMD execution or generate a hash tree, ...
sha3_tree's user avatar
  • 103
10 votes
1 answer
7k views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
user2589389's user avatar
9 votes
3 answers
6k views

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. so we have analyzed the NIST test vectors for SHA3, which states that append "0x06" (never used 1 followed by 'j'...
Vani's user avatar
  • 91
9 votes
1 answer
2k views

Outlook of trustworthiness of SHA-2

On the Wikipedia page of SHA-2, the following is written: Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512, and ...
matthias_buehlmann's user avatar
8 votes
2 answers
2k views

Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

Why is SHA-3 prefixed with “SHA” despite the fact that it is structurally different from SHA-2 and SHA-1? SHA-0, 1 & 2 and MD5 is based on Merkle–Damgård construction, while SHA-3 falls under ...
Nathan Aw's user avatar
  • 2,277
8 votes
1 answer
1k views

Free Start Collision In SHA-3

Given that the five sub-functions that comprise SHA-3 are reversible an individual can produce specific outputs of their choosing. The following is to my knowledge an example of a free start collision ...
Q-Club's user avatar
  • 1
8 votes
2 answers
5k views

SHA-3 block sizes / bitrate calculation?

Looking into different papers and online documents, I find the following block sizes for SHA-3: SHA3-224: 1152 Bit SHA3-256: 1088 Bit SHA3-384: 832 Bit SHA3-512: 576 Bit Somehow I am unable to find (...
Dennis's user avatar
  • 183
8 votes
1 answer
2k views

Keccak padding implementation, and bit ordering

I am trying to implement Keccak in Java for my school work. And I am getting stuck in two places: On the summary page the padding is shown as P = M || 0x01 || 0x00 || … || 0x00 P = P xor (0x00 |...
Soham's user avatar
  • 255
8 votes
1 answer
8k views

What is the chance of a collision when using SHA-3?

I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars). ...
biw's user avatar
  • 195
7 votes
1 answer
469 views

Any point in waiting for the SHA-3 standard?

The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter? That is, can we just assume it's going to be as specified by the submitters (...
Random Oracle's user avatar
7 votes
2 answers
757 views

Is there a quick way to know the length of a message hashed using SHA3?

Let M be the message that has been padded for use into the SHA3 (standardized Keccak) hash function. Is there a way, like it's the case for SHA1, to know the total length of the message M just by ...
Symeof's user avatar
  • 268
7 votes
2 answers
606 views

Will a SHAKE128 stream cipher be vulnerable to related key attacks?

Suppose that SHAKE is seeded with key concatenated to an IV, will the 'key' stream produced by SHAKE128 vulnerable to related key attacks like RC4 is? My guess is no because seed is already "...
DannyNiu's user avatar
  • 9,216
6 votes
1 answer
2k views

Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?

I'm trying to learn about sponge function for creating hash functions and generic attacks on it. I'm looking for the collision finding attack scenario which leads to $O(\min(2^{-n/2} , 2^{-c/2}))$ ...
Shnd's user avatar
  • 495
6 votes
2 answers
415 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
Luis Casillas's user avatar
6 votes
2 answers
2k views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
BCS's user avatar
  • 363
5 votes
2 answers
3k views

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The output length of SHAKE128 and SHAKE256 is variable, but their strengths are still said ...
Melab's user avatar
  • 3,655
5 votes
2 answers
3k views

What makes SHA-2 and SHA-3 have security levels half their output hash length?

The tag wiki for sha-256 says, in part: SHA-256 ... processes the input in 512-bit block and has a 256-bit output, for a 128-bit security level. I'm not a cryptographer, just an interested amateur,...
user's user avatar
  • 273
5 votes
2 answers
911 views

Are variable-length crypto hash functions still susceptible to collisions?

I just recently learned that the SHA-3 finalist Keccak allows for variable length output. As the only answer to this question states, "[it] need to have an output length at least equal to the input ...
Patrick M's user avatar
  • 419
5 votes
1 answer
877 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
Maarten Bodewes's user avatar
  • 92.7k
5 votes
1 answer
980 views

Equivalent security of KMAC and different HMAC instances?

In the August 2016 draft of SP 800-185, SHA-3 Derived Functions (pdf) there is a table for equivalent security settings for KMAC, the MAC derived from SHA-3, and some previous MACs (Table 1 on pages ...
otus's user avatar
  • 32.1k
4 votes
2 answers
1k views

Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?

I know that sponge functions are different in many ways. Yet I'd like to know if SHA-3 can nonetheless be said to be "based", if not simply "inspired", by the Merkle-Damgård construction. To be more ...
Symeof's user avatar
  • 268
4 votes
1 answer
1k views

What is the current time limit of Keccak inversion? [closed]

All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this ...
Q-Club's user avatar
  • 1