104
votes
Why isn’t SHA-3 in wider use?
First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, ...
56
votes
Accepted
What is the difference between SHA-3 and SHA-256?
The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are:
Resistance to length extension attacks.
With SHA-256, ...
- 49.1k
50
votes
Accepted
What advantages does Keccak/SHA-3 have over BLAKE2?
(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.)
Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
- 2,192
41
votes
Why is SHA-3 robust against Length-Extension Attacks?
Everything was changed between SHA-2 and SHA-3.
In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
- 87.7k
35
votes
Accepted
Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"
"nobody has a rainbow table for [this scheme]"
Well, this is a huge claim so needs justification. Building a rainbow table is not hard. Once you are a target, the table will be ready. For ...
- 49.3k
31
votes
Accepted
Why is SHA3 more secure than SHA2?
TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance.
Addition: there are reasons to prefer SHA3, including being a ...
- 144k
30
votes
Accepted
Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?
SHA3 is the name of the hash function standard, and the acronym is for 'Secure Hash Algorithm', pretty neutral one saying nothing about the structure. The algorithm itself was originally named Keccak ...
- 848
22
votes
Why is SHA3 more secure than SHA2?
This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint.
The first and most obvious is the ...
- 13.2k
20
votes
Why is SHA-3 a Sponge function?
… SHA3 (Bouncycastle) constrains me …
Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function.
See, when talking about SHA-3, you're talking about ...
- 18k
18
votes
Accepted
SHAKE-128/256 or SHA3-256/512
And in which case would it be more interesting to use one or another?
So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision ...
- 46.3k
18
votes
Accepted
SHA3-255, one bit less
With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit ...
16
votes
Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?
No. That is about as accurate as saying that airplanes are based on motorcycles, because they both have engines.
In MD, the input to the hash is converted to a key, which is used by a block cipher to ...
- 13.2k
15
votes
What is the current time limit of Keccak inversion?
But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion.
That is incorrect as you don't need a time limit ...
- 10k
15
votes
Why isn’t SHA-3 in wider use?
Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion:
I believe that ...
- 150k
14
votes
What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?
They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
- 87.7k
13
votes
Accepted
Free Start Collision In SHA-3
NO, you can't !
I will only consider initial_vector_0 and next_block_0.
What you have found is this:
...
- 10k
13
votes
What is the difference between SHA-3 and SHA-256?
Difference between SHA256 and SHA3
The main difference of SHA256 and SHA3 are their internal algorithm design.
SHA2 (and SHA1) are built using the Merkle–Damgård structure.
SHA3 on the other hand is ...
- 6,502
11
votes
What is an extendable output function?
As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
- 49.1k
11
votes
Why is SHA-3 a Sponge function?
SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity).
SHA-3 defines only these ...
- 2,141
11
votes
SHAKE-128/256 or SHA3-256/512
You should generally just use SHAKE128, but you should make sure that within your application, you don't use the SHAKE128 hash (to any length) of the same data for two different purposes. For example,...
- 49.1k
11
votes
Outlook of trustworthiness of SHA-2
AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
- 49.3k
10
votes
Padding in Keccak SHA3 hashing algorithm
In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned.
I beg to differ. From the FIPS 202. section B2.:
For most applications, the message is byte-aligned, i.e., $len(...
- 10k
10
votes
What security do Cryptographic Sponges offer against generic quantum attacks?
Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$.
To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
- 49.1k
10
votes
Accepted
SHA-3 block sizes / bitrate calculation?
First of all, in the case of SHA-3 we don't call it block size but bitrate.
SHA-3 has been formally defined in FIPS 202 and in its reference manual.
We define the sponge function denoted by $\...
- 10k
10
votes
Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?
SHA…
This naming was introduced by NIST (see https://csrc.nist.gov/Projects/Hash-Functions) way back in 1993 during SHA-0 standardization efforts (which ended in SHA-1).
SHA stands for Secure Hash ...
- 18k
10
votes
What is the sponge construction in simple terms?
I find that the following image from Wikipedia, though perhaps a bit too technical for your purposes, is still helpful with a little explanation:
Essentially, a function $f$ is used repeatedly in two ...
- 1,259
10
votes
Why is SHA3 more secure than SHA2?
I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
8
votes
Accepted
Is it secure to hash an AES key?
Would it be secure to use SHA-3 (or SHAKE) to hash the key, and then distribute the hash as the public ID for the secret key?
Sure; SHA-3 and SHAKE are effective uninvertable. Now, I suppose someone ...
- 150k
8
votes
Accepted
How does KECCAK operate on a state array filled with zeros?
I personally find the Keccak.team Psuedo Code document very helpful to understand how Keccak-p works.
As DannyNiu said in the comments, most (all?) cryptographic permutation employ "round ...
- 2,430
7
votes
Accepted
SHA-3 Sub-Function Reversibility Clarification
Hash functions are generally designed by splitting the problem into two parts:
A fixed size core function. This is called the compression function in most hashes, but in Keccak it's called the ...
- 14.6k
Only top scored, non community-wiki answers of a minimum length are eligible