5 ms·

This is a bit pointless, since it does not say on which platform the comparison is made. In any case, KangarooTwelve [1][2] (on AVX-512) is also 10x faster tha

This is a bit pointless, since it does not say on which platform the comparison is made. In any case, KangarooTwelve [1][2] (on AVX-512) is also 10x faster than SHA-256. KangarooTwelve is a fast hash function of the Keccak family (from which the SHA-3 derives from), and it is clearly what BLAKE3 tries to catch up with. However, KangarooTwelve probably benefits from the more extensive scrutiny that SHA-3 has received and will receive, and (from a performance standpoint) from future HW extensions that will speed it up even more (the first one appeared on ARMv8.2). [1] https://keccak.team/files/KangarooTwelve.pdf https://keccak.team/files/KangarooTwelve.pdf [2] https://www.cryptologie.net/article/393/kangarootwelve/ https://www.cryptologie.net/article/393/kangarootwelve/

throwawaymath 7y ago
There is a comparison of Blake3 to various hash functions (including SHA-2 and SHA-3 families) on AWS c5.metal; see the chart here: https://github.com/BLAKE3-team/BLAKE3 https://github.com/BLAKE3-team/BLAKE3
- zimmerfrei 7y ago
  Yes, and it didn't go unnoticed that KangarooTwelve (which - mind - does not belong to the SHA-3 family right now) is not included on that prominent comparison diagram, while it is considered in the BLAKE3 paper.
  - throwawaymath 7y ago
    That's a good point; I was just giving you a handy chart with an explicitly called out platform :)
  - oconnor663 7y ago
    I felt it would've been unfair to include KangarooTwelve in that particular bar chart, because at 16 KiB of input it hasn't reached its peak throughput. At the same time, the goal was to focus on more widely used algorithms.
loeg 7y ago
BLAKE was a SHA-3 finalist and received similar scrutiny to Keccak. Blake2 is, AFAIK, more widely adopted in software than SHA-3 and KangarooTwelve combined. Part of this is that Keccak, as specified in SHA-3, is incredibly slow in software -- NIST not only encouraged a ridiculous number of rounds, but also biased their decision-making in favor of hardware implementations. I'm not sure to what extent we'll see significant SHA-3 adoption outside of any future FIPS software requirements. You are probably correct about the additional scrutiny SHA-3 will receive, just as a side effect of its use in future FIPS-compliant software.

throwawaymath 7y ago

There is a comparison of Blake3 to various hash functions (including SHA-2 and SHA-3 families) on AWS c5.metal; see the chart here: https://github.com/BLAKE3-team/BLAKE3 https://github.com/BLAKE3-team/BLAKE3

zimmerfrei 7y ago
Yes, and it didn't go unnoticed that KangarooTwelve (which - mind - does not belong to the SHA-3 family right now) is not included on that prominent comparison diagram, while it is considered in the BLAKE3 paper.
- throwawaymath 7y ago
  That's a good point; I was just giving you a handy chart with an explicitly called out platform :)
- oconnor663 7y ago
  I felt it would've been unfair to include KangarooTwelve in that particular bar chart, because at 16 KiB of input it hasn't reached its peak throughput. At the same time, the goal was to focus on more widely used algorithms.

loeg 7y ago

BLAKE was a SHA-3 finalist and received similar scrutiny to Keccak. Blake2 is, AFAIK, more widely adopted in software than SHA-3 and KangarooTwelve combined. Part of this is that Keccak, as specified in SHA-3, is incredibly slow in software -- NIST not only encouraged a ridiculous number of rounds, but also biased their decision-making in favor of hardware implementations. I'm not sure to what extent we'll see significant SHA-3 adoption outside of any future FIPS software requirements. You are probably correct about the additional scrutiny SHA-3 will receive, just as a side effect of its use in future FIPS-compliant software.