Hot answers tagged

47 votes
Accepted

What advantages does Keccak/SHA-3 have over BLAKE2?

(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.) Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
user avatar
  • 2,134
36 votes

What advantages does Keccak/SHA-3 have over BLAKE2?

Blake-2 was not part of the SHA-3 competition, Blake, its predecessor was. Blake-2 is approx 1.3 to 1.7 times faster than Blake in software, with the advantage best for the 512-bit digests. ...
user avatar
  • 12.7k
27 votes
Accepted

Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
user avatar
  • 31.3k
20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
user avatar
  • 17.4k
19 votes
Accepted

What are the key differences between the draft SHA-3 standard and the Keccak submission?

No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed. The padding change is the only difference, this allows ...
user avatar
  • 12.7k
16 votes
Accepted

How secure would HMAC-SHA3 be?

The Keccak submission says: From the security claim in [12], a PRF constructed using HMAC shall resist a distinguishing attack that requires much fewer than $2^{c/2}$ queries and significantly less ...
user avatar
15 votes

What is the current time limit of Keccak inversion?

But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. That is incorrect as you don't need a time limit ...
user avatar
  • 9,789
11 votes

What is an extendable output function?

As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
user avatar
11 votes

Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
user avatar
  • 2,081
10 votes

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. I beg to differ. From the FIPS 202. section B2.: For most applications, the message is byte-aligned, i.e., $len(...
user avatar
  • 9,789
10 votes

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
user avatar
  • 85.1k
10 votes
Accepted

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

See chapter 5.11.2 of the paper “Cryptographic sponge functions” (the link can be found here): Note that one can also define a MAC function by taking as input the message followed by the key: $...
user avatar
9 votes

Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of ...
user avatar
  • 31.3k
9 votes
Accepted

Different padding rules for Merkle–Damgård and Keccak/sponge function

Actually, the Merkle–Damgård construction also specifies a padding bit after the message. The length is there the ensure that a padded message cannot be the suffix of a different longer message. A ...
user avatar
  • 12.7k
9 votes

Using Keccak permutation as a block cipher

First, this is a slightly silly exercise because most applications are not well-served by a block cipher in particular but rather by things built out of them, such as authenticated encryption schemes. ...
user avatar
8 votes

Why does KangarooTwelve only use 12 rounds?

I. Intuition: collision only on 6 rounds. KangarooTwelve aims at fast hashing but also claims 128-bits security. This can be seen in the fact that the capacity is set to 256 allowing a rate of 1344 ...
user avatar
  • 9,789
8 votes

What security do Cryptographic Sponges offer against generic quantum attacks?

Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$. To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
user avatar
8 votes
Accepted

SHA-3 block sizes / bitrate calculation?

First of all, in the case of SHA-3 we don't call it block size but bitrate. SHA-3 has been formally defined in FIPS 202 and in its reference manual. We define the sponge function denoted by $\...
user avatar
  • 9,789
8 votes

How does KECCAK operate on a state array filled with zeros?

I personally find the Keccak.team Psuedo Code document very helpful to understand how Keccak-p works. As DannyNiu said in the comments, most (all?) cryptographic permutation employ "round ...
user avatar
7 votes
Accepted

What are the uses of arbitrary length output hashes (other than OAEP)?

Uses for SHAKE/XOF functions Community wiki answer, please add and edit: key derivation of any type such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair deterministic ...
7 votes
Accepted

Can you use SHAKE256_XOF with XOR to make a stream cipher?

In section 3.2 "Modes of use of sponge functions" of Cryptographic Sponge Functions (CSF for short for the purpose of this answer), the authors listed several "modes of operations" ...
user avatar
  • 6,621
6 votes

Replacing the PRF in PBKDF2 with Keccak

Is there anything wrong with swapping SHA2 for Keccak for use in PBKDF2? There are 2 main issues. Performance and implementation. Performance The performance issue is from an attacker-defender ...
user avatar
  • 12.7k
6 votes
Accepted

What's the proper choice for the block size of a sponge-based hash?

The "block size" matters for Merkle-Damgård functions because the HMAC security proof relies on that block size. For other functions, and in particular sponge functions, the block size for HMAC is ...
user avatar
6 votes

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The security strengths of a random oracle are indeed functions of its output length and ...
user avatar
6 votes

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The inner functions have been specifically designed to only support 128 bit or 256 bit security: it's half of the capacity of 256 or 512 bits. The underlying functions or structure do not change. You ...
user avatar
  • 85.1k
6 votes
Accepted

Security of Keccak/SHA3 against birthday attacks

Let us correct some of your numbers. The size of the capacity is twice the size of the expected security margin (against a birthday attack). This is the idea of flat sponge clain etc When using a ...
user avatar
  • 9,789
6 votes
Accepted

Use sha3 for passwords hashing

Is sha3 better than sha2 in (m)any aspects? SHA3 is built on-top of a fundamentally different construction than SHA-2 which has many nice properties. So yes, in many hash-function relevant aspects it ...
user avatar
  • 44.6k
6 votes
Accepted

Security of XORing hashes vs concatenating

The answer is (as always): It depends. If you want pseudorandomness, then XOR is a good combiner (actually even optimal). However, if you want collision resistance then XOR is a really bad combiner ...
user avatar
  • 2,870
6 votes
Accepted

What does Keccak being "efficiently invertible" mean?

What does "efficiently invertible" mean in this case? It isn't reversible (as in decryption), so what else could that mean? Why is Keccak invertible? Is it by design or did they not bother ...
user avatar
  • 19.2k
5 votes

Padding in Keccak SHA3 hashing algorithm

Your confusion comes from the SHA-03 domain, the padding is as specified 10*1; however when you prepend the domains to the padding you get: domain result used in 01 M||0110*1 ...
user avatar
  • 181

Only top scored, non community-wiki answers of a minimum length are eligible