What would be the expected performance of hashing a seed with counters and using its keystream compared to SHAKE-256?

Question

Hashing a seed with SHAKE-256 and setting the output size to 1GiB it takes 6.5 seconds on my system:

$ time dd if=/dev/random count=40960 bs=1 &>/dev/null | shake256sum -N 8589934592 > /dev/null 
real    0m6.497s
user    0m5.682s
sys 0m0.844s

/\ 165.2 MiB/s

SHAKE-256 can be used to generate keys of any size as an (experienced) user of this forum stated.

Let's suppose I want to use pure SHA3-256 instead of SHAKE.

I can generate a key/keystream of any size with SHA3-256 by using:

keystream = H(00∥S)∥H(01∥S)∥H(02∥S)∥H(03∥S)...

H is the Hash, S is the seed.

My question is:

Does hashing a seed with counter using SHA3-256 would have a similar performance that of SHAKE-256? Will I have a speed near 165.2 MiB/s if I use SHA3 in this way? (These two hash functions have similar performances).

Answer 1

Does hashing a seed with counter using SHA3-256 would have a similar performance that of SHAKE-256? Will I have a speed near 165.2 MiB/s if I use SHA3 in this way?

The answer for almost any performance question usually comes down to "it's implementation dependent".

In this case, we can attempt to give an estimate (with the cavaets below).

For SHAKE-256, it needs to perform a permutation once every 1088 bits (or 136 bytes). For SHA3-256, every hash performed will need to perform (at least) one permutation, and so we end up with one permutation every 256 bits (or 32 bytes).

Given that evaluating the permutation can be expected to take the vast majority of the time, we would expect that SHAKE-256 would generate output about 4 times as fast as SHA3-256.

On the other hand, SHAKE cannot be parallelized (we cannot evaluate the next permutation until we finish with the previous one); in contrast, there's nothing preventing us from evaluating multiple SHA3-256 hashes at the same time (assuming our hardware is so capable). I believe that an AVX-2 implementation of SHA3-256 can perform 4 hashes in about the same time as a non-AVX implementation can evaluate a single hash; if we use such an implementation, SHA3-256 would generate output approximately as fast as SHAKE. And, if we were to use AVX-512 (which can do 8 hashes in parallel), the SHA3-256 would actually be faster (however, I haven't had any experience with AVX-512).

And so, bottom line: it depends on the implementation.