Questions tagged [keccak]

SHA-3, originally known as Keccak, is a cryptographic hash function designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.

Filter by
Sorted by
Tagged with
2
votes
0answers
70 views

Clarification about the iota function of SHA-3

I am trying to implement SHA-3 using this document and have a question about the iota step. This step consists in a single XOR between the central (0, 0) lane of the state (illustration of the state p....
4
votes
1answer
176 views

Is KMAC just SHA-3-256(KEY || message)

According to keccak strengths you have: Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be ...
0
votes
0answers
36 views

How such so called Merkle pre image are computed?

I’ve just encountered the following source code which is used as an authentication mechanism where the bytes32 leaf is the hashed action to authenticate : ...
1
vote
0answers
38 views

What are the differences between the various Authenticated Encryption schemes using Keccak?

Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption. However, there already seem multiple schemes defined for it, including their own implementations: ...
0
votes
0answers
56 views

Using a bit sequence of zeros followed by one byte in Keccak

For what purpose it is not right to use a bit sequence of 2000+ zeros followed by one byte in Keccak? Is there a possible application of such input for Keccak? If yes, after which transformation?
3
votes
1answer
112 views

Can a SHA3 engine be used to construct a Keccak implementation?

I am working on a cSHAKE-128 & cSHAKE-256 implementation that takes advantage of a number of hardware accelerators I have at my disposal, specifically for SHA-3 256/384/512 and SHAKE 128/256. ...
3
votes
1answer
94 views

SHA3 hexadecimal paddig odd length string

Section B2 of FIPS-202 specification describes the Hexadecimal Form of Padding Bits which is basically the translation of the bit padding 0110*1. However at the beginning they suppose that the message ...
3
votes
2answers
241 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
4
votes
2answers
181 views

How does KECCAK operate on a state array filled with zeros?

Im trying to implement a sponge in Java. The state starts out as an empty 200 byte array of all zeros. In the KMAC samples document from NIST, the following happens: (black line is a pdf page break) ...
3
votes
3answers
153 views

Some questions on building permutations from boolean functions

I've seen multiple examples of boolean functions being used as a permutation. For example the Keccak Chi : 2.3.1 function: from https://keccak.team/figures.html Or as a formula: for $i=\{0..4\}$ $A_i=...
1
vote
1answer
102 views

Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?

I have the following data (represented as hex from binary below) where the lower bytes is controlled by attacker in the second case : ...
1
vote
2answers
223 views

For data shorter than 32 bytes, is it sure that no collision exists?

I’m not talking about if a collision can be found but even simply exists. The point is since it’s shorter than the length of the hash (since I’m talking about keccak256), normally there’s a hash ...
0
votes
1answer
81 views

How to interpret a specific mathematical notation in "FIPS 202" (SHA-3 / Keccak)

tl;dr What does "d <= |Z|" mean in the context of bit array manipulations? As a learning exercise I'm working on an implementation of SHA-3. I am not a cryptography specialist in any way but I ...
3
votes
1answer
403 views

What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?

Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
3
votes
0answers
64 views

Small(er)-lane Keccak-f: impact and usage

Keccak defines a family of hash functions, by building a sponge out of a permutation Keccak-$f[b]: \{0,1\}^b \rightarrow \{0,1\}^b$. This permutation function is parametrised using $b$, which is the ...
0
votes
1answer
95 views

What does the minimal number of round of "nr" use Keccak to avoid “collision attack”?

What does the minimal number of round of "nr" use Keccak to avoid collision attack? $$nr = 12+2L$$
5
votes
1answer
106 views

What are the uses of arbitrary length output hashes (other than OAEP)?

Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications. I know that ...
3
votes
2answers
222 views

What are the values of $w$ such that the corresponding $\text{Keccak-}f[25w]$ function is invertible (bijective)?

From this answer, I see that from a mathematical point of view, one could define the $\text{Keccak-}f[25w]$ permutation for an arbitrary value of $w$. I am interested in the following question: ...
4
votes
1answer
167 views

Is it reasonable to assume that $\text{Keccak-}f[25n]$ block permutation is defined for any value of $n$?

Wikipedia contains the following claim for $\text{Keccak-}f[25w]$: It is defined for any power-of-two word size, $w = 2^ℓ$ bits. Although all official descriptions of Keccak do not explicitly ...
2
votes
1answer
136 views

Given a particular $1600$-bit output $Y$, is it feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?

I have read this answer on Crypto.SE and I want to clarify a few details. Does this property of $\text{Keccak-}f[1600](x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible ...
2
votes
1answer
278 views

Capacity bits in SHA-3

I am trying to understand the sponge construction, and in the official web site I found this sentence: The last c bits of the state are never directly affected by the input blocks and are never ...
4
votes
2answers
468 views

Intuition for SHA3 sponge construction

I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation. Let's consider the case where we have don't apply $f$ in the squeezing ...
4
votes
1answer
372 views

What does Keccak being "efficiently invertible" mean?

Reading through Wikipedia, I saw this: It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge ...
0
votes
2answers
414 views

What is a permutation in Keccak?

I am trying to understand Ethereum's hash algorithm Keccak. Keccak uses permutations in the hashing process. Could anyone explain me what this permutation looks like or how it works ? I only know ...
1
vote
1answer
253 views

Simplifying the description of the Keccak padding rules

I would like to check if my following understanding of Keccak padding has any flaws and if there are, please feel free to point them out and correct them. The Keccak version I am interested is the ...
1
vote
1answer
144 views

shake-128 in 32-bits platform

I am implementing shake in 32-bits microcontroller, so I would like to use bit interleaving. I checked the code in: https://github.com/floodyberry/supercop/blob/master/crypto_hash/keccak/simple32bi/...
0
votes
1answer
358 views

rotation offsets for KECCAK-$f$[800]

So let's say you're trying to do SHA3-224. If you're on a 64-bit machine you'd presumably use KECCAK-$f$[1600]. In-so-far as I understand it'd have the following parameters: Rate: 448 (2*224) ...
7
votes
2answers
307 views

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

$\require{begingroup}\begingroup \DeclareMathOperator{\keccak}{\mathrm{Keccak}} \DeclareMathOperator{\concat}{\|} $According to Keccak's website, $\keccak(k \concat x)$ is safe: Unlike SHA-1 and ...
3
votes
1answer
402 views

why was padding changed when keccak became sha3?

In the original Keccak you would pad by adding a 1 bit proceeded by a predetermined amount of 0 bits and then another 1 bit. When Keccak was standardized to sha3 the padding was changed. It was then (...
1
vote
2answers
358 views

Best way, how to convert 32-byte Keccak hashes to positive numbers up to maximum?

I have 32-byte Keccak hashes and I have some maximum number, for example 500, how to uniformly convert those hashes to pseudo-random positive numbers up to that ...
6
votes
1answer
514 views

What is the size of codomain of a function $G(x) = F^A(x) \oplus F^B(x)$, where $F(x) = \text{Keccak-}f[1600](x)$?

Assuming that $m$ is a multiset of bitstrings where all bitstrings have the same length, let $D(m)$ denote the number of distinct elements in $m$. That is, $D(m)$ is equal to the dimension of $m$. For ...
3
votes
1answer
122 views

Are there known special cases where the first 160 bits of keccak256 can be null ? Or does finding a collision is required?

In the Tronix contract code (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers : ...
3
votes
2answers
157 views

What are the consequences if someone finds the accessible 1600-bit block $X$ and $R$-bit block $V$ such that $\text{Keccak-}f[1600](X \oplus V) = X$?

Let $H$ denote any hash function based on the sponge construction. Let $F$ denote its underlying function that transforms the $L$-bit state (for SHA-3, $F = \text{Keccak-}f[1600]$ ). Let $R$ denote ...
2
votes
1answer
591 views

Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
2
votes
1answer
1k views

Security of XORing hashes vs concatenating

On this question https://stackoverflow.com/questions/5889238/why-is-xor-the-default-way-to-combine-hashes a couple of the answers say that xoring is a bad/insecure choice for combining hashes. However,...
0
votes
1answer
99 views

Identify Keccak Algorithm

I need to analyse a binary code and check if Keccak is used in this code. I can identify AES, by using Rijndael S-box. Is there a similiar box for Keccak?
2
votes
0answers
205 views

Closest Keccak256 hashes by Hamming distance? [closed]

What are the two "closest" known Keccak256 (not SHA-3 256) hashes in terms of the Hamming distance between the pair of hashes? EDIT: This was marked as opinion based, so to clarify, when I asked this ...
3
votes
0answers
804 views

SHA3 hardware implementation [closed]

I am studying SHA3 in order to create a hardware implementation, preferably in verilog. I have downloaded VHDL reference implementation from https://keccak.team/hardware.html. The code is great, and ...
0
votes
1answer
317 views

How would Keccak attain a 512-bit security level?

I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that. ...
12
votes
2answers
4k views

Why is SHA-3 a Sponge function?

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
3
votes
1answer
290 views

Strength of Hash obtained by XOR of parts of SHA3

I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail has the last 64 bits. Next, I XOR head and tail. Which ...
2
votes
1answer
2k views

Use sha3 for passwords hashing

Is use of sha3 justifiable? Is sha3 better than sha2 in (m)any aspects? P.S. I want to use hashing for passwords in a database
6
votes
1answer
749 views

Using Keccak permutation as a block cipher

The inverse of Keccak is slow, but if you have a problem where that is not a concern would this be a secure cipher? The encryption function can be made incredibly fast in hardware. Or the reverse if ...
7
votes
1answer
1k views

What is an extendable output function?

The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
0
votes
1answer
431 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
0
votes
1answer
326 views

Correct integer input value for keccak 256 [closed]

Assuming that we use k = sha3.keccak_256()(pysha3 package). How should one convert integer input for a function ...
4
votes
1answer
898 views

What is the current time limit of Keccak inversion? [closed]

All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this ...
0
votes
1answer
112 views

What are the properties of a function based on multiple iterations of a pseudo-random permutation?

Let $F(S) = \text{Keccak-}f[1600](S)$. Assuming that the length of $S$ is equal to $1600 \times k$ and if $k$ is greater than $1$, we define a function $F_{k}(S)$ as follows. We note that $S$ is ...
4
votes
1answer
122 views

What is the expected number of different sequences of bits in the collection that contains $2^{800}$ elements?

Let $F$ denote a function that returns the first $800$ bits of the input. Let $G(N)$ denote a function that returns the last $800$ bits of the binary encoding of the given number $N$. For example, ...
2
votes
1answer
178 views

Is the Keccak family of sponge constructions the same as SHA-3?

I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as ...