Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
51 votes
Accepted

What advantages does Keccak/SHA-3 have over BLAKE2?

(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.) Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
Zooko's user avatar
  • 2,184
20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
e-sushi's user avatar
  • 17.9k
15 votes

What is the current time limit of Keccak inversion?

But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. That is incorrect as you don't need a time limit ...
Biv's user avatar
  • 9,988
11 votes

What is an extendable output function?

As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
Squeamish Ossifrage's user avatar
11 votes

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
Maarten Bodewes's user avatar
  • 92.9k
11 votes

Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
Dennis's user avatar
  • 2,141
10 votes

What security do Cryptographic Sponges offer against generic quantum attacks?

Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$. To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
Squeamish Ossifrage's user avatar
10 votes

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. I beg to differ. From the FIPS 202. section B2.: For most applications, the message is byte-aligned, i.e., $len(...
Biv's user avatar
  • 9,988
10 votes
Accepted

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

See chapter 5.11.2 of the paper “Cryptographic sponge functions” (the link can be found here): Note that one can also define a MAC function by taking as input the message followed by the key: $...
lyrically wicked's user avatar
9 votes

Using Keccak permutation as a block cipher

First, this is a slightly silly exercise because most applications are not well-served by a block cipher in particular but rather by things built out of them, such as authenticated encryption schemes. ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

SHA-3 block sizes / bitrate calculation?

First of all, in the case of SHA-3 we don't call it block size but bitrate. SHA-3 has been formally defined in FIPS 202 and in its reference manual. We define the sponge function denoted by $\...
Biv's user avatar
  • 9,988
9 votes
Accepted

Can you use SHAKE256_XOF with XOR to make a stream cipher?

In section 3.2 "Modes of use of sponge functions" of Cryptographic Sponge Functions (CSF for short for the purpose of this answer), the authors listed several "modes of operations" ...
DannyNiu's user avatar
  • 9,361
8 votes

Why does KangarooTwelve only use 12 rounds?

I. Intuition: collision only on 6 rounds. KangarooTwelve aims at fast hashing but also claims 128-bits security. This can be seen in the fact that the capacity is set to 256 allowing a rate of 1344 ...
Biv's user avatar
  • 9,988
8 votes
Accepted

How does KECCAK operate on a state array filled with zeros?

I personally find the Keccak.team Psuedo Code document very helpful to understand how Keccak-p works. As DannyNiu said in the comments, most (all?) cryptographic permutation employ "round ...
Ruben De Smet's user avatar
7 votes
Accepted

What are the uses of arbitrary length output hashes (other than OAEP)?

Uses for SHAKE/XOF functions Community wiki answer, please add and edit: key derivation of any type such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair deterministic ...
6 votes
Accepted

What's the proper choice for the block size of a sponge-based hash?

The "block size" matters for Merkle-Damgård functions because the HMAC security proof relies on that block size. For other functions, and in particular sponge functions, the block size for HMAC is ...
Thomas Pornin's user avatar
6 votes

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The general idea is that the security strength of a good hash function is equal to half it's output length. The security strengths of a random oracle are indeed functions of its output length and ...
Luis Casillas's user avatar
6 votes

If the output size of SHAKE128/256 is variable, why is the security fixed at 128/256?

The inner functions have been specifically designed to only support 128 bit or 256 bit security: it's half of the capacity of 256 or 512 bits. The underlying functions or structure do not change. You ...
Maarten Bodewes's user avatar
  • 92.9k
6 votes
Accepted

Security of Keccak/SHA3 against birthday attacks

Let us correct some of your numbers. The size of the capacity is twice the size of the expected security margin (against a birthday attack). This is the idea of flat sponge clain etc When using a ...
Biv's user avatar
  • 9,988
6 votes
Accepted

Use sha3 for passwords hashing

Is sha3 better than sha2 in (m)any aspects? SHA3 is built on-top of a fundamentally different construction than SHA-2 which has many nice properties. So yes, in many hash-function relevant aspects it ...
SEJPM's user avatar
  • 46.1k
6 votes
Accepted

Cache Timing Attack SHA-3

SHA-3 is not vulnerable to cache timing attack. Only implementations could be vulnerable to timing attacks. Also it is to be noted that cache timing attacks relate secret data and cache lines ...
Biv's user avatar
  • 9,988
6 votes
Accepted

Security of XORing hashes vs concatenating

The answer is (as always): It depends. If you want pseudorandomness, then XOR is a good combiner (actually even optimal). However, if you want collision resistance then XOR is a really bad combiner ...
mephisto's user avatar
  • 2,908
5 votes
Accepted

Reasoning behind SHA-3 state array indexing

First let us have a look at the state representation. For all triples $(x,y,z)$ such that $0 \le x < 5$, $0 \le y < 5$, and $0 \le z < w$, $$A[x,y,z]=S[w(5y+x)+z].$$ For example, if $b = ...
Biv's user avatar
  • 9,988
5 votes

Padding in Keccak SHA3 hashing algorithm

Your confusion comes from the SHA-03 domain, the padding is as specified 10*1; however when you prepend the domains to the padding you get: domain result used in 01 M||0110*1 ...
Gregor y's user avatar
  • 181
5 votes

Best way, how to convert 32-byte Keccak hashes to positive numbers up to maximum?

Your "32-byte Keccak hash" doesn't look like a canonical, binary Keccak output, but rather appears to be encoded with some Base64 variant—to me it appears to be the MIME version. Your comments on the ...
Luis Casillas's user avatar
5 votes
Accepted

why was padding changed when keccak became sha3?

It accomplishes 2 things. SHA-3 hashes of the same input will be distinct from Keccak hashes with the same rate/capacity. XOFs (SHAKE) with the same rate/capacity will start also with distinct hash ...
Richie Frame's user avatar
  • 13.1k
5 votes

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

Keccak(x||k) is very likely secure, but it is less efficient than Keccak(k||x) for multiple messages. The standardized MAC construction for use with Keccak is KMAC as defined in FIPS 800-185. In KMAC,...
rmalayter's user avatar
  • 2,297
5 votes
Accepted

What does Keccak being "efficiently invertible" mean?

What does "efficiently invertible" mean in this case? It isn't reversible (as in decryption), so what else could that mean? Why is Keccak invertible? Is it by design or did they not bother ...
Ella Rose's user avatar
  • 19.6k
5 votes
Accepted

Intuition for SHA3 sponge construction

So if it's just a permutation of 0s and 1s as we've concluded, what is hard about finding an alternate message string that satisfies the constrains I've mentioned on the permutation outcome? To be ...
Ella Rose's user avatar
  • 19.6k
5 votes
Accepted

Is KMAC just SHA-3-256(KEY || message)

Standard KMAC is more than that thanks to domain separation prefixes; NIST SP 800-185 KMAC128(K, X, L, S): Validity Conditions: $\text{len}(K) < 2^{2040}$ and $0 \le L < 2^{2040}$ and $\text{...
kelalaka's user avatar
  • 48.7k

Only top scored, non community-wiki answers of a minimum length are eligible