4 ms·

I wonder why SHA-256, and not BLAKE2(b/s) or BLAKE3. BLAKE3 is significantly faster.

by sargun 6y ago

altmind 6y ago
because the speed is not the only concern. also, sha2 is already hardware accelerated, and may still be faster than the rest of the hashes.
bawolff 6y ago
Does performance matter in this context? Git isn't exactly hashing terabytes of data.
- JoshTriplett 6y ago
  It does; I've encountered some cases (ingesting large amounts of data into git) where the limiting factor on performance is a combination of SHA-1 and DEFLATE.
- hobofan 6y ago
  You don't think that GitHub has to hash petabytes of their users data?
slavik81 6y ago
SHA-256 is faster when hardware accelerated, and was judged to be a more conservative choice. You can find their evaluation here: https://public-inbox.org/git/20180609224913.GC38834@genre.crustytoothpaste.net/ https://public-inbox.org/git/20180609224913.GC38834@genre.cr...
- JoshTriplett 6y ago
  That post was made in mid 2018, and BLAKE3 wasn't published until late 2019; I don't think it was considered. SHA256 with hardware acceleration might be competitive with BLAKE2, but not with BLAKE3 (performance graph at https://raw.githubusercontent.com/BLAKE3-team/BLAKE3/master/media/speed.svg?sanitize=true https://raw.githubusercontent.com/BLAKE3-team/BLAKE3/master/... ). BLAKE3 is also capable of being heavily parallelized without changing its output, as well as quickly updated without rehashing entire objects (if you keep some partial hashes around). Overall, it'd be quite desirable. Hopefully all the work to abstract the choice of hash algorithm will make it relatively straightforward to prototype the use of other hashes.
  - zimmerfrei 6y ago
    They did consider and ruled out KangarooTwelve, which has basically the same properties of BLAKE3 while being derived from Keccak (therefore, with more chances of ending up as a US federal standard).
    - JoshTriplett 6y ago
      KangarooTwelve didn't have the same performance as BLAKE3 though.
      - zimmerfrei 6y ago
        It roughly does. Note that it is not present in the comparison chart you posted...
        oconnor663 6y ago
        I'd agree that it roughly does. It's omitted from that chart mainly because it's not very common, but also because the input length measured there would makes K12's throughout appear lower than it should. The BLAKE3 paper contains more detailed graphs across a spectrum of input lengths.
  - dependenttypes 6y ago
    I think that part of the performance gain of BLAKE3 is due to the fact that it uses a Merkle tree or something. SHA-3 has ParallelHash. One could use that with KangarooTwelve potentially. I would really like an AES-based hash function as AES-NI is much faster compared to chacha20. There was a function called echo that worked like that during the SHA-3 competition but it was dropped before the final round.

I wonder why SHA-256, and not BLAKE2(b/s) or BLAKE3. BLAKE3 is significantly faster.

by sargun 6y ago

I wonder why SHA-256, and not BLAKE2(b/s) or BLAKE3. BLAKE3 is significantly faster.

because the speed is not the only concern. also, sha2 is already hardware accelerated, and may still be faster than the rest of the hashes.

bawolff 6y ago

Does performance matter in this context? Git isn't exactly hashing terabytes of data.

JoshTriplett 6y ago
It does; I've encountered some cases (ingesting large amounts of data into git) where the limiting factor on performance is a combination of SHA-1 and DEFLATE.
hobofan 6y ago
You don't think that GitHub has to hash petabytes of their users data?

slavik81 6y ago

SHA-256 is faster when hardware accelerated, and was judged to be a more conservative choice. You can find their evaluation here: https://public-inbox.org/git/20180609224913.GC38834@genre.crustytoothpaste.net/ https://public-inbox.org/git/20180609224913.GC38834@genre.cr...

JoshTriplett 6y ago
That post was made in mid 2018, and BLAKE3 wasn't published until late 2019; I don't think it was considered. SHA256 with hardware acceleration might be competitive with BLAKE2, but not with BLAKE3 (performance graph at https://raw.githubusercontent.com/BLAKE3-team/BLAKE3/master/media/speed.svg?sanitize=true https://raw.githubusercontent.com/BLAKE3-team/BLAKE3/master/... ). BLAKE3 is also capable of being heavily parallelized without changing its output, as well as quickly updated without rehashing entire objects (if you keep some partial hashes around). Overall, it'd be quite desirable. Hopefully all the work to abstract the choice of hash algorithm will make it relatively straightforward to prototype the use of other hashes.
- zimmerfrei 6y ago
  They did consider and ruled out KangarooTwelve, which has basically the same properties of BLAKE3 while being derived from Keccak (therefore, with more chances of ending up as a US federal standard).
  - JoshTriplett 6y ago
    KangarooTwelve didn't have the same performance as BLAKE3 though.
    - zimmerfrei 6y ago
      It roughly does. Note that it is not present in the comparison chart you posted...
      - oconnor663 6y ago
        I'd agree that it roughly does. It's omitted from that chart mainly because it's not very common, but also because the input length measured there would makes K12's throughout appear lower than it should. The BLAKE3 paper contains more detailed graphs across a spectrum of input lengths.
- dependenttypes 6y ago
  I think that part of the performance gain of BLAKE3 is due to the fact that it uses a Merkle tree or something. SHA-3 has ParallelHash. One could use that with KangarooTwelve potentially. I would really like an AES-based hash function as AES-NI is much faster compared to chacha20. There was a function called echo that worked like that during the SHA-3 competition but it was dropped before the final round.