47
votes
Accepted
What advantages does Keccak/SHA-3 have over BLAKE2?
(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.)
Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
- 2,134
36
votes
What advantages does Keccak/SHA-3 have over BLAKE2?
Blake-2 was not part of the SHA-3 competition, Blake, its predecessor was. Blake-2 is approx 1.3 to 1.7 times faster than Blake in software, with the advantage best for the 512-bit digests.
...
- 12.7k
27
votes
Accepted
Is HMAC needed for a SHA-3 based MAC?
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC?
No, you don't need to do ...
- 31.3k
20
votes
Why is SHA-3 a Sponge function?
… SHA3 (Bouncycastle) constrains me …
Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function.
See, when talking about SHA-3, you're talking about ...
- 17.4k
19
votes
Accepted
What are the key differences between the draft SHA-3 standard and the Keccak submission?
No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed.
The padding change is the only difference, this allows ...
- 12.7k
16
votes
Accepted
How secure would HMAC-SHA3 be?
The Keccak submission says:
From the security claim in [12], a PRF constructed using HMAC shall resist a distinguishing attack that requires much fewer than $2^{c/2}$ queries and significantly less ...
- 44.4k
15
votes
What is the current time limit of Keccak inversion?
But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion.
That is incorrect as you don't need a time limit ...
- 9,789
11
votes
What is an extendable output function?
As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
- 45.8k
11
votes
Why is SHA-3 a Sponge function?
SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity).
SHA-3 defines only these ...
- 2,081
10
votes
Padding in Keccak SHA3 hashing algorithm
In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned.
I beg to differ. From the FIPS 202. section B2.:
For most applications, the message is byte-aligned, i.e., $len(...
- 9,789
10
votes
Is HMAC needed for a SHA-3 based MAC?
KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
- 85.1k
10
votes
Accepted
Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$
See chapter 5.11.2 of the paper “Cryptographic sponge functions” (the link can be found here):
Note that one can also define a MAC function by taking as input the message followed
by the key: $...
- 1,154
9
votes
Where did the SHAKEs come from in SHA3?
Where did SHAKE128 and SHAKE256 originate from?
They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of ...
- 31.3k
9
votes
Accepted
Different padding rules for Merkle–Damgård and Keccak/sponge function
Actually, the Merkle–Damgård construction also specifies a padding bit after the message. The length is there the ensure that a padded message cannot be the suffix of a different longer message. A ...
- 12.7k
9
votes
Using Keccak permutation as a block cipher
First, this is a slightly silly exercise because most applications are not well-served by a block cipher in particular but rather by things built out of them, such as authenticated encryption schemes. ...
- 45.8k
8
votes
Why does KangarooTwelve only use 12 rounds?
I. Intuition: collision only on 6 rounds.
KangarooTwelve aims at fast hashing but also claims 128-bits security. This can be seen in the fact that the capacity is set to 256 allowing a rate of 1344 ...
- 9,789
8
votes
What security do Cryptographic Sponges offer against generic quantum attacks?
Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$.
To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
- 45.8k
8
votes
Accepted
SHA-3 block sizes / bitrate calculation?
First of all, in the case of SHA-3 we don't call it block size but bitrate.
SHA-3 has been formally defined in FIPS 202 and in its reference manual.
We define the sponge function denoted by $\...
- 9,789
8
votes
How does KECCAK operate on a state array filled with zeros?
I personally find the Keccak.team Psuedo Code document very helpful to understand how Keccak-p works.
As DannyNiu said in the comments, most (all?) cryptographic permutation employ "round ...
- 2,083
7
votes
Accepted
What are the uses of arbitrary length output hashes (other than OAEP)?
Uses for SHAKE/XOF functions
Community wiki answer, please add and edit:
key derivation of any type
such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair
deterministic ...
7
votes
Accepted
Can you use SHAKE256_XOF with XOR to make a stream cipher?
In section 3.2 "Modes of use of sponge functions" of Cryptographic Sponge Functions (CSF for short for the purpose of this answer), the authors listed several "modes of operations" ...
- 6,621
6
votes
Replacing the PRF in PBKDF2 with Keccak
Is there anything wrong with swapping SHA2 for Keccak for use in PBKDF2?
There are 2 main issues. Performance and implementation.
Performance
The performance issue is from an attacker-defender ...
- 12.7k
6
votes
Accepted
What's the proper choice for the block size of a sponge-based hash?
The "block size" matters for Merkle-Damgård functions because the HMAC security proof relies on that block size. For other functions, and in particular sponge functions, the block size for HMAC is ...
- 84.6k
6
votes
If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?
The general idea is that the security strength of a good hash function is equal to half it's output length.
The security strengths of a random oracle are indeed functions of its output length and ...
- 14k
6
votes
If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?
The inner functions have been specifically designed to only support 128 bit or 256 bit security: it's half of the capacity of 256 or 512 bits. The underlying functions or structure do not change.
You ...
- 85.1k
6
votes
Accepted
Security of Keccak/SHA3 against birthday attacks
Let us correct some of your numbers. The size of the capacity is twice the size of the expected security margin (against a birthday attack). This is the idea of flat sponge clain etc
When using a ...
- 9,789
6
votes
Accepted
Use sha3 for passwords hashing
Is sha3 better than sha2 in (m)any aspects?
SHA3 is built on-top of a fundamentally different construction than SHA-2 which has many nice properties. So yes, in many hash-function relevant aspects it ...
- 44.6k
6
votes
Accepted
Security of XORing hashes vs concatenating
The answer is (as always): It depends. If you want pseudorandomness, then XOR is a good combiner (actually even optimal). However, if you want collision resistance then XOR is a really bad combiner ...
- 2,870
6
votes
Accepted
What does Keccak being "efficiently invertible" mean?
What does "efficiently invertible" mean in this case? It isn't reversible (as in decryption), so what else could that mean?
Why is Keccak invertible? Is it by design or did they not bother ...
- 19.2k
5
votes
Padding in Keccak SHA3 hashing algorithm
Your confusion comes from the SHA-03 domain, the padding is as specified 10*1; however when you prepend the domains to the padding you get:
domain result used in
01 M||0110*1 ...
- 181
Only top scored, non community-wiki answers of a minimum length are eligible