2022 Developer Survey is open! Take survey.

Hot answers tagged

98 votes

Why isn’t SHA-3 in wider use?

First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, ...
user avatar
47 votes
Accepted

What advantages does Keccak/SHA-3 have over BLAKE2?

(Disclosure: I'm one of the authors of BLAKE2, but not BLAKE.) Here are the slides from a presentation I gave at Applied Cryptography and Network Security 2013 about this. (Note: the performance ...
user avatar
  • 2,134
40 votes

Why is SHA-3 robust against Length-Extension Attacks?

Everything was changed between SHA-2 and SHA-3. In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
user avatar
38 votes
Accepted

What is the difference between SHA-3 and SHA-256?

The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are: Resistance to length extension attacks. With SHA-256, ...
user avatar
36 votes

What advantages does Keccak/SHA-3 have over BLAKE2?

Blake-2 was not part of the SHA-3 competition, Blake, its predecessor was. Blake-2 is approx 1.3 to 1.7 times faster than Blake in software, with the advantage best for the 512-bit digests. ...
user avatar
  • 12.6k
30 votes
Accepted

Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

SHA3 is the name of the hash function standard, and the acronym is for 'Secure Hash Algorithm', pretty neutral one saying nothing about the structure. The algorithm itself was originally named Keccak ...
user avatar
  • 771
29 votes
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
user avatar
  • 122k
27 votes
Accepted

Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
user avatar
  • 31.2k
22 votes

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
user avatar
  • 12.6k
20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
user avatar
  • 17.4k
19 votes
Accepted

What are the key differences between the draft SHA-3 standard and the Keccak submission?

No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed. The padding change is the only difference, this allows ...
user avatar
  • 12.6k
18 votes
Accepted

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

As of now I can think of four different applications for XOFs. Note that some change the padding depending on the requested output size and so the outputs are truly unrelated, Skein does this. ...
user avatar
  • 44.6k
18 votes
Accepted

SHA3-255, one bit less

With all well-regarded hash functions, the bits of the hash all have equal worth: as far as anyone knows (unless they aren't telling), the bits are not correlated. If you take $k$ bits of an $n$-bit ...
user avatar
16 votes
Accepted

How secure would HMAC-SHA3 be?

The Keccak submission says: From the security claim in [12], a PRF constructed using HMAC shall resist a distinguishing attack that requires much fewer than $2^{c/2}$ queries and significantly less ...
user avatar
16 votes

Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?

No. That is about as accurate as saying that airplanes are based on motorcycles, because they both have engines. In MD, the input to the hash is converted to a key, which is used by a block cipher to ...
user avatar
  • 12.6k
15 votes

What is the current time limit of Keccak inversion?

But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. That is incorrect as you don't need a time limit ...
user avatar
  • 9,789
14 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
user avatar
14 votes
Accepted

SHAKE-128/256 or SHA3-256/512

And in which case would it be more interesting to use one or another? So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision ...
user avatar
  • 44.6k
14 votes

Why isn’t SHA-3 in wider use?

Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion: I believe that ...
user avatar
  • 131k
13 votes
Accepted

Free Start Collision In SHA-3

NO, you can't ! I will only consider initial_vector_0 and next_block_0. What you have found is this: ...
user avatar
  • 9,789
11 votes

What is an extendable output function?

As defined in FIPS 202, whereas SHA3-256 is a function mapping an arbitrary-length bit string to a string of 256 bits, the extendable output function SHAKE256 is a function mapping an arbitrary-length ...
user avatar
11 votes

Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
user avatar
  • 2,081
11 votes

What is the difference between SHA-3 and SHA-256?

Difference between SHA256 and SHA3 The main difference of SHA256 and SHA3 are their internal algorithm design. SHA2 (and SHA1) are built using the Merkle–Damgård structure. SHA3 on the other hand is ...
user avatar
  • 6,316
11 votes

SHAKE-128/256 or SHA3-256/512

You should generally just use SHAKE128, but you should make sure that within your application, you don't use the SHAKE128 hash (to any length) of the same data for two different purposes. For example,...
user avatar
11 votes

Outlook of trustworthiness of SHA-2

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
user avatar
  • 43.1k
10 votes

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
user avatar
  • 84.7k
10 votes

Padding in Keccak SHA3 hashing algorithm

In FIPS-202 specification, the padding required for SHA3 were not clearly mentioned. I beg to differ. From the FIPS 202. section B2.: For most applications, the message is byte-aligned, i.e., $len(...
user avatar
  • 9,789
10 votes

Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
user avatar
9 votes

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

NIST has yet to standardize any accepted uses for these functions. As they said in response to a comment on the SHA-3 draft (pdf) which questioned this: The text in Section 7 on conformance ...
user avatar
  • 31.2k

Only top scored, non community-wiki answers of a minimum length are eligible