50
votes
Accepted
What advantages does Keccak/SHA-3 have over BLAKE2?
(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.)
Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
- 2,164
37
votes
What advantages does Keccak/SHA-3 have over BLAKE2?
Blake-2 was not part of the SHA-3 competition, Blake, its predecessor was. Blake-2 is approx 1.3 to 1.7 times faster than Blake in software, with the advantage best for the 512-bit digests.
...
- 13k
16
votes
Accepted
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
I'm answering the following which was asked in the original question:
Why is stock chacha20 not good as a cryptographic hash? Why create BLAKE?
Why not simply apply the one-way compression function ...
- 7,629
14
votes
Accepted
Argon2 with SHA-256 instead of Blake2
If you take a look at the Password Hashing Competiton, you can see, that most of the schemes use Blake2b, some of them uses SHA-512, none of them uses SHA-256.
Blake2b is optimized for 64-bit ...
- 985
14
votes
Accepted
Should I use SHA256 or Blake2 to checksum and sign scrypt headers?
Note that Blake2's security goals are a superset of those of SHA-256:
SHA-256 is conjectured to be collision resistant, preimage resistant and second preimage resistant.
Blake2 is conjectured to be ...
- 14.4k
13
votes
Accepted
Blake2 vs md5 for checksum / file integrity
Yes, you should choose BLAKE2 instead of MD5. Any of the BLAKE2 variants—BLAKE2s, BLAKE2b, BLAKE2sp, BLAKE2bp—is an improvement over MD5, even if you just use them for 128-bit digest sizes like MD5, ...
8
votes
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
OK, so the core ChaCha primitive (for any fixed number of rounds) is a function $\operatorname{ChaCha}: \{0,1\}^{256}\times \{0,1\}^{64}\times\{0,1\}^{64}\to \{0,1\}^{512}$ which is believed to be a ...
- 45.7k
6
votes
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
Why is stock chacha20 not good as a cryptographic hash?
You haven't specified what kind of ‘cryptographic hash’ you mean, but since you're comparing it to BLAKE, it sounds like you're looking for ...
6
votes
Accepted
Blake2: truncate 512-bit hash is safer than 256-bit by Config?
You should always use config options to select the output size of a hash function.
If you need a standard output size (e.g. 224, 256, 384, 512 bit) use the recommended parameter set.
This mainly ...
- 45.7k
6
votes
Accepted
Blake2B as a KDF
Actually, what you want is possible with plain Blake2b - if your implementation supports the full specification (PDF) (which is marked as optional by RFC 7693).
If this is the case, you'd do the ...
- 45.7k
6
votes
Accepted
Security of XORing hashes vs concatenating
The answer is (as always): It depends. If you want pseudorandomness, then XOR is a good combiner (actually even optimal). However, if you want collision resistance then XOR is a really bad combiner ...
- 2,888
6
votes
Accepted
Why invent new hash functions for zero-knowledge proofs?
Let us see an example of how cryptographic hash functions are used in Zero-Knowledge Proof Systems. Following code written in Zokrates DSL Toolbox is an example of computing a Hash using Zero-...
- 343
6
votes
Accepted
Understanding the HAIFA (hash iterative framework) structure
HAsh Iterative FrAmework (HAIFA) proposed by Biham and Dunkelman, in 2005-2007. The main idea of the work is to fix the flaws of Merkle and Damgård (MD) construction. Interestingly, MD was invented ...
- 47.6k
5
votes
Accepted
Recommended key lengths for BLAKE2b
The Analysis of BLAKE2's Modes of Operation paper gives a PRF bound for keyed BLAKE2b with a key of size $k$, under the assumption that the underlying block cipher is ideal (Corollary 3):
$$
\text{Adv}...
- 12.4k
5
votes
Accepted
blake2b length extension attack approach
BLAKE2 is not open-source. BLAKE2 is a specification.
The state is shuffled one last time after having set the final bit, ensuring that a small change, even a single bit, yields a completely ...
- 2,944
5
votes
Accepted
Why HAIFA and sponge constructions are not prone to length extension attacks?
Sponge Construction
In sponge construction, the block size $b$ has two parts, $r$ is the rate and it is the written part and $c$ capacity is the untouched part by the input/output, $b= c+r$
The ...
- 47.6k
4
votes
Is there any concrete reason to call BLAKE more secure than BLAKE2?
I guess that reducing the rounds is indeed the main reason to call it less secure. Generally attacks are over a specific number of rounds. If better attacks are found then the reduction of rounds ...
- 91.9k
4
votes
BLAKE2: What is the difference between the salt and the personalization?
Context should be constant for one "keystore": that is the property of the KDF that is used for namespacing the salt space and make sure that two different application (or keystore) will not reuse the ...
- 276
4
votes
Blake2B as a KDF
Shortening the definition of HKDF (for sufficiently short output) it is just:
HMAC(HMAC(XTS, SKM), CTXinfo || 0)
(format: ...
- 4,883
4
votes
Blake2 vs md5 for checksum / file integrity
If in doubt, use BLAKE2, not MD5.
If security is necessary, then you should avoid MD5. It has a weakness where someone can create two files which differ, but which have the same MD5 digest. This is ...
- 15.1k
4
votes
Accepted
Is Blake2b vulnerable to length extension attacks?
All from the BLAKE2 paper BLAKE2: simpler, smaller, fast as MD5
First of all
BLAKE2b is optimized for 64-bit platforms — including NEON-enabled
ARMs — and produces digests of any size between 1 and ...
- 47.6k
4
votes
Accepted
Why blake2b is the fastest despite it being 512 bits hashing algorithm?
I am struggling to understand why blake2b is faster than blake2s, despite that blake2b is 512 bits hashing.
Comparing is not easy. They designed
BLAKE2b for 64-bit platforms including NEON enabled ...
- 47.6k
4
votes
Is Argon2 based on BLAKE2b or is it only using the BLAKE2b at the end?
Argon2 uses BLAKE2b in several different ways, which can be seen in the Wikipedia article on it. It's first used to hash the parameters, including the password, and then used in a construct that ...
- 2,981
3
votes
Argon2 with SHA-256 instead of Blake2
From reading the Argon2 paper, it would be safe, but not wise, to use SHA-256 instead of Blake2:
We allow to choose another compression function G, hash function H, block size b, and number of ...
- 15.1k
3
votes
Accepted
Ed25519 key generation
The second step has nothing to do with the first step. It doesn't matter which hash is used in the first step. For X25519, which operates on an equivalent curve Curve25519, the private key is obtained ...
3
votes
Accepted
Is there any concrete reason to call BLAKE more secure than BLAKE2?
The approach is not so much ‘compromising security in the name of speed’, but rather engineering something the world is confident provides at least a prescribed security level, and then tweaking it to ...
3
votes
Accepted
Early propagation of carries in the BLAKE hash function
This is already covered by Ella's response, but in short the added nonlinearity at the start buys you very little in terms of security, compared to its cost in number of operations. It would be more ...
- 12.4k
3
votes
Accepted
Can Blake2 be a replacement for double SHA-256?
BLAKE2 can be used as a drop-in replacement for SHA-256d, yes. It is not vulnerable to the length extension attack. Whether or not you should use it in cryptocurrency is a more complex question, but ...
- 15.1k
3
votes
Accepted
How is Argon2's Blake2b different than normal Blake2b?
You are correct when you say that in this case no compression is required and
that a symmetric block cipher could also be used for this purpose.
Several considerations probably played a role in the ...
- 985
2
votes
Accepted
Is the use of a 4-round Blake2b permutation in OPP justified?
4 rounds of Blake2b is essentially equivalent to 8 rounds of ChaCha in terms of complexity (a Blake2 round is close to a ChaCha double-round), and that has not yet been broken. Like Richie Frame wrote ...
- 32k
Only top scored, non community-wiki answers of a minimum length are eligible