News for hackers. Stuff that matters.

A comment on Maybe we shouldn't skip SHA-3. Parent comment

Re:Maybe we shouldn't skip SHA-3 by aseipp on Friday June 02, 2017 @09:35AM (#14469740)
The parameters NIST specified are just fairly conservative, for one thing (e.g. NIST, IIRC, oddly requested an increase in the number of rounds during the final stages, one of the things people waxed on about.)

Regarding another variant: yes, you can get more compelling results, and the authors of Keccak themselves have also proposed another function based on Keccak called KangarooTwelve[1]. K12 has much better performance and parallelism than SHA-3 does in software. (Of course, if you don't need most of Keccak's general properties, you're probably fine with other hashes anyway.)

[1] http://keccak.noekeon.org/KangarooTwelve.pdf

[ Parent | on HN ]
Re:Maybe we shouldn't skip SHA-3 by nincompope on Friday June 02, 2017 @03:30PM (#14472678)
As far as I can tell, the increase from 18 to 24 rounds was not NIST's call, but due to the zero-sum distinguishers found on Keccak-f, which made it no longer "hermetic": http://keccak.noekeon.org/NoteZeroSum.pdf
[ Parent | on HN ]