# Tag Info

## Hot answers tagged keccak

Accepted

### What advantages does Keccak/SHA-3 have over BLAKE2?

(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.) Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
• 2,134

### What advantages does Keccak/SHA-3 have over BLAKE2?

Blake-2 was not part of the SHA-3 competition, Blake, its predecessor was. Blake-2 is approx 1.3 to 1.7 times faster than Blake in software, with the advantage best for the 512-bit digests. ...
• 12.7k
Accepted

### Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
• 31.3k

### Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
• 17.4k
Accepted

### What are the key differences between the draft SHA-3 standard and the Keccak submission?

No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed. The padding change is the only difference, this allows ...
• 12.7k
Accepted

### How secure would HMAC-SHA3 be?

The Keccak submission says: From the security claim in [12], a PRF constructed using HMAC shall resist a distinguishing attack that requires much fewer than $2^{c/2}$ queries and significantly less ...
• 44.4k

### What is the current time limit of Keccak inversion?

But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. That is incorrect as you don't need a time limit ...
• 9,789

### What is an extendable output function?

As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
• 45.8k

### Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
• 2,081

• 1,154

### Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of ...
• 31.3k
Accepted

### Different padding rules for Merkle–Damgård and Keccak/sponge function

Actually, the Merkle–Damgård construction also specifies a padding bit after the message. The length is there the ensure that a padded message cannot be the suffix of a different longer message. A ...
• 12.7k

### Using Keccak permutation as a block cipher

First, this is a slightly silly exercise because most applications are not well-served by a block cipher in particular but rather by things built out of them, such as authenticated encryption schemes. ...
• 45.8k

### Why does KangarooTwelve only use 12 rounds?

I. Intuition: collision only on 6 rounds. KangarooTwelve aims at fast hashing but also claims 128-bits security. This can be seen in the fact that the capacity is set to 256 allowing a rate of 1344 ...
• 9,789

### What security do Cryptographic Sponges offer against generic quantum attacks?

Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$. To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
• 45.8k
Accepted

### SHA-3 block sizes / bitrate calculation?

First of all, in the case of SHA-3 we don't call it block size but bitrate. SHA-3 has been formally defined in FIPS 202 and in its reference manual. We define the sponge function denoted by \$\...
• 9,789

### How does KECCAK operate on a state array filled with zeros?

I personally find the Keccak.team Psuedo Code document very helpful to understand how Keccak-p works. As DannyNiu said in the comments, most (all?) cryptographic permutation employ "round ...
• 2,083
Accepted

### What are the uses of arbitrary length output hashes (other than OAEP)?

Uses for SHAKE/XOF functions Community wiki answer, please add and edit: key derivation of any type such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair deterministic ...
Accepted

### Can you use SHAKE256_XOF with XOR to make a stream cipher?

In section 3.2 "Modes of use of sponge functions" of Cryptographic Sponge Functions (CSF for short for the purpose of this answer), the authors listed several "modes of operations" ...
• 6,621

### Replacing the PRF in PBKDF2 with Keccak

Is there anything wrong with swapping SHA2 for Keccak for use in PBKDF2? There are 2 main issues. Performance and implementation. Performance The performance issue is from an attacker-defender ...
• 12.7k
Accepted

### What's the proper choice for the block size of a sponge-based hash?

The "block size" matters for Merkle-Damgård functions because the HMAC security proof relies on that block size. For other functions, and in particular sponge functions, the block size for HMAC is ...
• 84.6k

### If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The security strengths of a random oracle are indeed functions of its output length and ...

### If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The inner functions have been specifically designed to only support 128 bit or 256 bit security: it's half of the capacity of 256 or 512 bits. The underlying functions or structure do not change. You ...
• 85.1k
Accepted

### Security of Keccak/SHA3 against birthday attacks

Let us correct some of your numbers. The size of the capacity is twice the size of the expected security margin (against a birthday attack). This is the idea of flat sponge clain etc When using a ...
• 9,789
Accepted

### Use sha3 for passwords hashing

Is sha3 better than sha2 in (m)any aspects? SHA3 is built on-top of a fundamentally different construction than SHA-2 which has many nice properties. So yes, in many hash-function relevant aspects it ...
• 44.6k
Accepted

### Security of XORing hashes vs concatenating

The answer is (as always): It depends. If you want pseudorandomness, then XOR is a good combiner (actually even optimal). However, if you want collision resistance then XOR is a really bad combiner ...
• 2,870
Accepted

### What does Keccak being "efficiently invertible" mean?

What does "efficiently invertible" mean in this case? It isn't reversible (as in decryption), so what else could that mean? Why is Keccak invertible? Is it by design or did they not bother ...
• 19.2k