5 ms·

SHA-512 is 1.5x faster than SHA-256 on 64-bit platforms

123 points by steffenweber 10y ago

dchest 10y ago
Similarly: BLAKE2s (32-bit words) - 554 MiB/s BLAKE2b (64-bit words) - 890 MiB/s (source: https://blake2.net/ https://blake2.net/) The difference is also clear in pure JavaScript implementations — JS doesn't have native 64-bit integer operations yet, so SHA-512 is slower there: SHA-256 - 103.17 MiB/s SHA-512 - 34.29 MiB/s Note that since SHA-512 eats 128-byte blocks, while SHA-256 64-byte blocks, hashing very short strings may be faster with SHA-256 even on 64-bit platforms (the same applies to BLAKE2).
- shakna 10y ago
  > in pure JavaScript implementations Is not JS cryptography a bad idea?
  - angry_octet 10y ago
    No JS per se. In browser client side crypto though...
    - gcp 10y ago
      Harder to defend against timing attacks in JS, which are exactly some of the strongest attacks against modern cryptosystems.
      - angry_octet 10y ago
        Do you mean because of the lack of low level control/bit manipulation, vs C/asm, or something else? I would have guessed it was about the same as any interpreted/jitted higher level language (python/php/c#/java).
loeg 10y ago
Yep. Taking advantage of SHA512's superior performance while still producing a 256 bit result is the raison d'être of SHA-512/256.
- meta_AU 10y ago
  Well... only if you ignore the advantages of immunity to length extension.
deleted 10y ago
[deleted]
nstr10 10y ago
I would be curious to see this compared with SHA-384, and across multiple languages.
- cperciva 10y ago
  SHA-384 is exactly the same speed as SHA-512. SHA-512/256 is also the same speed -- it's basically SHA-512 with the output truncated to 256 bits.
- loeg 10y ago
  SHA 224/384 are just truncated forms of the same algorithm as SHA 256/512, respectively. (With different initial constants, as well, but that doesn't matter for this.)
hyh1048576 10y ago
As a side note, there are some cryptocurrency project using half of the sha512, since it's faster and using a 256 bit hash saves spaces.
joshuak 10y ago
We use this fact in our ID system. Consider bloom filters... so many different 'hash functions' you get for free out of 64 bytes of hash data.
kobeya 10y ago
"... amortized per byte." SHA-512 is in fact slower per iteration, but uses twice the block size as SHA-256. For hashing e.g. files, the per-byte number is what matters. But when doing hash trees, for example, the per-iteration performance is what matters and SHA-256 wins out there.

123 points by steffenweber 10y ago

Similarly: BLAKE2s (32-bit words) - 554 MiB/s BLAKE2b (64-bit words) - 890 MiB/s (source: https://blake2.net/ https://blake2.net/) The difference is also clear in pure JavaScript implementations — JS doesn't have native 64-bit integer operations yet, so SHA-512 is slower there: SHA-256 - 103.17 MiB/s SHA-512 - 34.29 MiB/s Note that since SHA-512 eats 128-byte blocks, while SHA-256 64-byte blocks, hashing very short strings may be faster with SHA-256 even on 64-bit platforms (the same applies to BLAKE2).

shakna 10y ago
> in pure JavaScript implementations Is not JS cryptography a bad idea?
- angry_octet 10y ago
  No JS per se. In browser client side crypto though...
  - gcp 10y ago
    Harder to defend against timing attacks in JS, which are exactly some of the strongest attacks against modern cryptosystems.
    - angry_octet 10y ago
      Do you mean because of the lack of low level control/bit manipulation, vs C/asm, or something else? I would have guessed it was about the same as any interpreted/jitted higher level language (python/php/c#/java).

loeg 10y ago

Yep. Taking advantage of SHA512's superior performance while still producing a 256 bit result is the raison d'être of SHA-512/256.

meta_AU 10y ago
Well... only if you ignore the advantages of immunity to length extension.

deleted 10y ago

[deleted]

nstr10 10y ago

I would be curious to see this compared with SHA-384, and across multiple languages.

cperciva 10y ago
SHA-384 is exactly the same speed as SHA-512. SHA-512/256 is also the same speed -- it's basically SHA-512 with the output truncated to 256 bits.
loeg 10y ago
SHA 224/384 are just truncated forms of the same algorithm as SHA 256/512, respectively. (With different initial constants, as well, but that doesn't matter for this.)

hyh1048576 10y ago

As a side note, there are some cryptocurrency project using half of the sha512, since it's faster and using a 256 bit hash saves spaces.

joshuak 10y ago

We use this fact in our ID system. Consider bloom filters... so many different 'hash functions' you get for free out of 64 bytes of hash data.

kobeya 10y ago

"... amortized per byte." SHA-512 is in fact slower per iteration, but uses twice the block size as SHA-256. For hashing e.g. files, the per-byte number is what matters. But when doing hash trees, for example, the per-iteration performance is what matters and SHA-256 wins out there.