3 ms·

Gambit used Keccak.

• dchest 11y ago
  Ah, true, I forgot about it. With the following remark in specs (https://password-hashing.net/submissions/specs/Gambit-v1.pdf https://password-hashing.net/submissions/specs/Gambit-v1.pdf): Keccak is known to be very fast in hardware, which opens up the path to highly optimized cheap circuits. (although with strange follow-up: "but the same can be said about modern CPUs and GPUs, which closes the gap") As I wrote when discussing candidates, "I like the simplicity of Gambit, but it would look a bit silly if we selected an algorithm as a winner of competition with a notice that it better be used in the future, when Intel adds a SHA-3 instruction."