2022 Developer Survey is open! Take survey.

Tag Info

Why isn’t SHA-3 in wider use?

First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, ...
Accepted

What advantages does Keccak/SHA-3 have over BLAKE2?

(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.) Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
• 2,134

Why is SHA-3 robust against Length-Extension Attacks?

Everything was changed between SHA-2 and SHA-3. In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
• 84.6k
Accepted

What is the difference between SHA-3 and SHA-256?

The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are: Resistance to length extension attacks. With SHA-256, ...
• 45.6k

What advantages does Keccak/SHA-3 have over BLAKE2?

Blake-2 was not part of the SHA-3 competition, Blake, its predecessor was. Blake-2 is approx 1.3 to 1.7 times faster than Blake in software, with the advantage best for the 512-bit digests. ...
• 12.6k
Accepted

Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

SHA3 is the name of the hash function standard, and the acronym is for 'Secure Hash Algorithm', pretty neutral one saying nothing about the structure. The algorithm itself was originally named Keccak ...
• 771
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
• 122k
Accepted

Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
• 31.2k

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
• 12.6k

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
• 17.4k
Accepted

What are the key differences between the draft SHA-3 standard and the Keccak submission?

No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed. The padding change is the only difference, this allows ...
• 12.6k
Accepted

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

As of now I can think of four different applications for XOFs. Note that some change the padding depending on the requested output size and so the outputs are truly unrelated, Skein does this. ...
• 44.6k
Accepted

SHA3-255, one bit less

With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit ...
Accepted

How secure would HMAC-SHA3 be?

The Keccak submission says: From the security claim in [12], a PRF constructed using HMAC shall resist a distinguishing attack that requires much fewer than $2^{c/2}$ queries and significantly less ...
• 44.3k

Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?

No. That is about as accurate as saying that airplanes are based on motorcycles, because they both have engines. In MD, the input to the hash is converted to a key, which is used by a block cipher to ...
• 12.6k

What is the current time limit of Keccak inversion?

But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. That is incorrect as you don't need a time limit ...
• 9,789

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
• 84.6k
Accepted

SHAKE-128/256 or SHA3-256/512

And in which case would it be more interesting to use one or another? So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision ...
• 44.6k

Why isn’t SHA-3 in wider use?

Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion: I believe that ...
• 131k
Accepted

Free Start Collision In SHA-3

NO, you can't ! I will only consider initial_vector_0 and next_block_0. What you have found is this: ...
• 9,789

What is an extendable output function?

As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
• 45.6k

Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
• 2,081

What is the difference between SHA-3 and SHA-256?

Difference between SHA256 and SHA3 The main difference of SHA256 and SHA3 are their internal algorithm design. SHA2 (and SHA1) are built using the Merkle–Damgård structure. SHA3 on the other hand is ...
• 6,316

SHAKE-128/256 or SHA3-256/512

You should generally just use SHAKE128, but you should make sure that within your application, you don't use the SHAKE128 hash (to any length) of the same data for two different purposes. For example,...
• 45.6k

Outlook of trustworthiness of SHA-2

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
• 43.1k

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
• 84.7k

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. I beg to differ. From the FIPS 202. section B2.: For most applications, the message is byte-aligned, i.e., \$len(...
• 9,789