Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement.

To quote Wikipedia:

>BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).

https://en.wikipedia.org/wiki/BLAKE_(hash_function)#BLAKE2

Reducing the rounds by 4 might raise eyebrows wrt security, but Aumasson's 'Too Much Crypto' discusses BLAKE vs BLAKE2 among other things: https://eprint.iacr.org/2019/1492.pdf

Why kernel devs didn't go with BLAKE3, I can't say.

Blake3 is still quite new (although it is a tested core) so I would say they made the right call.

It would only result in small incremental perf improvement due to reduced number of rounds (10 to 7).

Majority of Blake3's perf benefit manifests from merkle-tree structure and SIMD processing of multiple input streams at the same time.

> Why they didn't go with BLAKE3, I can't say.

Maybe people just liked it better that way?

BLAKE3 is written in Rust wile BLAKE2s is written in C. That is probably a lot easier to push through.

It also seems to be almost as fast according to the BLAKE3 specs PDF (page 11).

https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blak...

Giantrobot was going for a They Might Be Giants song reference

TMBG was a cover; It was The Four Lads originally I believe

I picked up on that reference too. I was about to type it up when I saw your comment. I think it went over a lot of heads.

Well, the singers might be giants after all.

BLAKE3 has a C implementation including many SIMD implementations. The C implementation only lacks multi-threading which BLAKE2 does not have.

It's BLAKE2, though BLAKE3 was hopeful,

but it just BLAKE2, BLAKE3 got a nope

SHA1's a long time gone, that crypto's a slowpoke

Why did BLAKE3 and SHA1 get the works?

That's nobody's business, even Turks!

claps :D

Don't. Think. Posts. Below. Got. Joke.

> Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement.

To add to this: BLAKE2 is derived from BLAKE only, whereas BLAKE3 is derived from Bao AND BLAKE2.

> Why kernel devs didn't go with BLAKE3, I can't say.

https://news.ycombinator.com/item?id=29748581

Your doubly linked comment (adrian_b’s remark) makes the incorrect assertion that the only reason blake3 is faster than blake2 is parallelism; this is objectively false. Blake3 uses fewer rounds (7x2) of the Chacha primitive than blake2 (10x2).

I think tptacek has it right: this thing is used very infrequently (period 300 seconds) and blake2 was already in the kernel, so they just reused it. It’s adequately fast, even if blake3 would be marginally faster.

I do not think that he claimed that the reason is performance, but regardless, I gave other reasons besides performance, too, including "blake2 was already in the kernel, so they just reused it". I said: "BLAKE2 is already in the kernel (with tests and everything), while BLAKE3 is not (at all)".

Yes, we agree here.

Thanks for the correction.

I'm not familiar with the kernel RNG specifically, but I think the hash function is only used with small inputs and outputs, and it's the stream cipher (ChaCha) that has the more performance-sensitive job of generating lots of output bytes. So the performance differences between BLAKE2s and BLAKE3 probably aren't very important here, and the fact that a BLAKE2s implementation is already in the kernel makes this an easy change.

That makes sense, thanks. I wonder if it might make sense to use a reduced-round Chacha for generation. Aumasson calls for 8 rounds; I think Rust’s CSPRNG uses 12.

Read this comment (or thread) as to why not BLAKE3: https://news.ycombinator.com/item?id=29746938

To sum up: BLAKE3 has no advantages over BLAKE2 when it comes to the Linux kernel[1], plus BLAKE2 is already in the kernel (with tests and everything), while BLAKE3 is not (at all). That, and BLAKE3 is still fairly new.

[1] It is faster than BLAKE2 due to parallelism, which is not suitable for the Linux kernel; you want to restrict computation to a single thread instead of making all the cores busy. FWIW, the C reference implementation is not multi-threaded either.