12 ms·
SHA-3 Standard [pdf]
- dchest 11y agoReleased today. Here are responses to draft comments: https://www.federalregister.gov/articles/2015/08/05/2015-19181/announcing-approval-of-federal-information-processing-standard-fips-202-sha-3-standard https://www.federalregister.gov/articles/2015/08/05/2015-191...
- AceJohnny2 11y agoThis was the result of the contest in 2012, commented by Bruce Schneier here: https://www.schneier.com/cgi-bin/mt/mt-search.cgi?search=SHA-3&__mode=tag&IncludeBlogs=2&limit=10&page=1 https://www.schneier.com/cgi-bin/mt/mt-search.cgi?search=SHA...
- AceJohnny2 11y agoAnyone have a VHDL or Verilog implementation of this? :) For that matter, I haven't looked at the algorithm. Is it readily implementable in hardware?
- zokier 11y agoThere is a VHDL implementation of Keccak on their homepage: http://keccak.noekeon.org/files.html http://keccak.noekeon.org/files.html
- JoachimS 11y agoWe have a SHA-3 core by Bernd Paysan written in Verilog in the Cryptech repo. http://wiki.cryptech.is/browser/core/hash/sha3 http://wiki.cryptech.is/browser/core/hash/sha3
- logicrime 11y agoFor non-scientists, what does this mean? Is SHA-2 not good anymore? What should I do?
- fortytw2 11y agoSHA-2 is still dandy - If I understand correctly SHA-3 is in an entirely different family of cryptographic hash functions, so that if/when a problem is discovered with SHA-2 there's another standard approved and ready to go - but that doesn't mean SHA-3 can't be used now.
- logicrime 11y agoI gotcha, that makes sense to do it that way, such that if the foundation of SHA-2 is compromised, SHA-3 can be deployed safely where it's needed.
- tptacek 11y agoSHA-2 is fine, and in fact the more conservative choice right now. SHA-3 didn't happen because SHA-2 was threatened. My current favorite conservative hash choice is SHA512/256, which is the SHA-2 that generates a 512-bit output but truncates it to 256. It gives you the same length extension protection that is the most important feature of SHA-3, and is available in most libraries already. I have never recommended to anyone that they switch from SHA-2 to SHA-3. I'm actually in "wait and see" mode about SHA-3; there are compelling other hashes available if you want to be ultra-modern about which hash you use.
- logicrime 11y agoSomebody else in this thread was talking about BLAKE2, which I cast a cursory glance at. It seems pretty cool, claims to evade the length-extension 'issues' that SHA-1 has. Wikipedia indicates that there has been at least some progress as far as cryptanalysis goes, but even with that being said, there's always that lingering 'but what if' about anything NSA-related.
- tptacek 11y agoSHA-2 is also length-extendable, which means you have to be careful when you use it to build a MAC. (That's why I like the truncated version). No cryptographer I know takes these particular "what-if's" seriously. They appear to come exclusively from non-cryptographers reacting to anything that NIST touched.
- infinity0 11y agoIf I were the NSA, how would I backdoor this?
- tedunangst 11y agoI would tell people new crypto can't be trusted, and they should stick with proven standards like MD5.
- johansch 11y agoThis is obviously not what they are saying.
- Retr0spectrum 11y agoThat's exactly what the NSA would say to get us to use a new, backdoored hash function! /s
- pshc 11y agoWhoa, finally! I've been oddly attached to Keccak's story over the years ever since it won the contest. Glad to see SHA-3 finished. Did NIST make any changes to the algorithm since? From what I can tell it looks like they only made clarifications. To celebrate, here's a hacked-up keccak-512 implementation in Rust: https://github.com/pshc/keccak https://github.com/pshc/keccak (I have yet to check whether it's actually SHA-3.)
- joeyh 11y agoI'm not clear either on whether anything substantial has changed since the April 2014 draft. Would be good to have some authoratative hash values to test libraries against. Glad to see it sets c = 2d at least.
- mykhal 11y agorecap: http://keccak.noekeon.org/fips202final.html http://keccak.noekeon.org/fips202final.html
- mykhal 11y agoXOF, nice.. but what is the point of expanding SHAKE256 to e.g. 4096 bits, if its security remains 256 bits ?
- amluto 11y agoTo derive 4096 bits of pseudorandom data from an input. For example, you could derive 16 256-bit keys from one master secret.
- e12e 11y ago"The KECCAK-p permutations were designed to be suitable as the main components for a variety of cryptographic functions, including keyed functions for authentication and/or encryption. The six SHA-3 functions can be considered as modes of operation (modes) of the KECCAK-p[1600,24] permutation. In the future, additional modes of this permutation or other KECCAK-p permutations may be specified and approved in FIPS publications or in NIST Special Publications. " Aww. Is there any news on a standard (NIST, or just informal RFC) on an authenticated encryption mode for KECCAK? I remember seeing a presentation of KECCAK at passwords[1] -- and I thought that part looked the most fun ;-) [1] http://passwords12.at.ifi.uio.no/ http://passwords12.at.ifi.uio.no/
- pbsd 11y agoI don't know about NIST standardization, but you can see what the Keccak team is planning with the Keyak and Ketje CAESAR candidates: http://keyak.noekeon.org/ http://keyak.noekeon.org/ http://ketje.noekeon.org/ http://ketje.noekeon.org/