103 votes

Why isn’t SHA-3 in wider use?

First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, ...
Gilles 'SO- stop being evil''s user avatar
52 votes
Accepted

What is the difference between SHA-3 and SHA-256?

The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are: Resistance to length extension attacks. With SHA-256, ...
Squeamish Ossifrage's user avatar
51 votes
Accepted

What advantages does Keccak/SHA-3 have over BLAKE2?

(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.) Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
Zooko's user avatar
  • 2,184
41 votes

Why is SHA-3 robust against Length-Extension Attacks?

Everything was changed between SHA-2 and SHA-3. In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
Thomas Pornin's user avatar
35 votes
Accepted

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

"nobody has a rainbow table for [this scheme]" Well, this is a huge claim so needs justification. Building a rainbow table is not hard. Once you are a target, the table will be ready. For ...
kelalaka's user avatar
  • 48.5k
31 votes
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
fgrieu's user avatar
  • 141k
30 votes
Accepted

Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

SHA3 is the name of the hash function standard, and the acronym is for 'Secure Hash Algorithm', pretty neutral one saying nothing about the structure. The algorithm itself was originally named Keccak ...
AYun's user avatar
  • 849
22 votes

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
Richie Frame's user avatar
  • 13.1k
20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
e-sushi's user avatar
  • 17.9k
18 votes
Accepted

SHAKE-128/256 or SHA3-256/512

And in which case would it be more interesting to use one or another? So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision ...
SEJPM's user avatar
  • 46k
18 votes
Accepted

SHA3-255, one bit less

With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit ...
Gilles 'SO- stop being evil''s user avatar
16 votes

Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?

No. That is about as accurate as saying that airplanes are based on motorcycles, because they both have engines. In MD, the input to the hash is converted to a key, which is used by a block cipher to ...
Richie Frame's user avatar
  • 13.1k
15 votes

What is the current time limit of Keccak inversion?

But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. That is incorrect as you don't need a time limit ...
Biv's user avatar
  • 9,979
14 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
Thomas Pornin's user avatar
14 votes

Why isn’t SHA-3 in wider use?

Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion: I believe that ...
poncho's user avatar
  • 147k
13 votes
Accepted

Free Start Collision In SHA-3

NO, you can't ! I will only consider initial_vector_0 and next_block_0. What you have found is this: ...
Biv's user avatar
  • 9,979
12 votes

What is the difference between SHA-3 and SHA-256?

Difference between SHA256 and SHA3 The main difference of SHA256 and SHA3 are their internal algorithm design. SHA2 (and SHA1) are built using the Merkle–Damgård structure. SHA3 on the other hand is ...
AleksanderCH's user avatar
  • 6,445
11 votes

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes

What is an extendable output function?

As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
Squeamish Ossifrage's user avatar
11 votes

Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
Dennis's user avatar
  • 2,151
11 votes

SHAKE-128/256 or SHA3-256/512

You should generally just use SHAKE128, but you should make sure that within your application, you don't use the SHAKE128 hash (to any length) of the same data for two different purposes. For example,...
Squeamish Ossifrage's user avatar
11 votes

Outlook of trustworthiness of SHA-2

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
kelalaka's user avatar
  • 48.5k
10 votes

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. I beg to differ. From the FIPS 202. section B2.: For most applications, the message is byte-aligned, i.e., $len(...
Biv's user avatar
  • 9,979
10 votes

What security do Cryptographic Sponges offer against generic quantum attacks?

Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$. To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
Squeamish Ossifrage's user avatar
10 votes

Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

SHA… This naming was introduced by NIST (see https://csrc.nist.gov/Projects/Hash-Functions) way back in 1993 during SHA-0 standardization efforts (which ended in SHA-1). SHA stands for Secure Hash ...
e-sushi's user avatar
  • 17.9k
10 votes

Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
R.. GitHub STOP HELPING ICE's user avatar
9 votes
Accepted

SHA-3 block sizes / bitrate calculation?

First of all, in the case of SHA-3 we don't call it block size but bitrate. SHA-3 has been formally defined in FIPS 202 and in its reference manual. We define the sponge function denoted by $\...
Biv's user avatar
  • 9,979
9 votes

What is the sponge construction in simple terms?

I find that the following image from Wikipedia, though perhaps a bit too technical for your purposes, is still helpful with a little explanation: Essentially, a function $f$ is used repeatedly in two ...
thesquaregroot's user avatar
8 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

While Switch is right about the difference between Merkle–Damgård and Sponge constructions, I don't believe he is correct as to NIST's reasoning. I happened to talk to a NIST cryptographer (John ...
poncho's user avatar
  • 147k

Only top scored, non community-wiki answers of a minimum length are eligible