3 ms·
SHA-3 (Keccak) is not a better choice, because it has a considerable performance difference between hardware and software implementations, while BLAKE is very f
by dchest 11y ago
SHA-3 (Keccak) is not a better choice, because it has a considerable performance difference between hardware and software implementations, while BLAKE is very fast in software (or current general-purpose CPUs), which is good for most defenders (as they use general purpose hardware) and bad for attackers (as the cost of specialized hardware is increased). None of the Password Hashing Competition submissions used Keccak, and even the authors of Keccak recommended against using it for password hashing.
- pbsd 11y agoGambit used Keccak.
- dchest 11y agoAh, true, I forgot about it. With the following remark in specs (https://password-hashing.net/submissions/specs/Gambit-v1.pdf https://password-hashing.net/submissions/specs/Gambit-v1.pdf): Keccak is known to be very fast in hardware, which opens up the path to highly optimized cheap circuits. (although with strange follow-up: "but the same can be said about modern CPUs and GPUs, which closes the gap") As I wrote when discussing candidates, "I like the simplicity of Gambit, but it would look a bit silly if we selected an algorithm as a winner of competition with a notice that it better be used in the future, when Intel adds a SHA-3 instruction."