Questions about SHA and SHAKE

Question

So I got bored one weekend so I thought I would make a login system in python. I then realized if I wanted to reuse the accounts I made I had to store the account details locally. I realized I had to use some sort of encryption. I looked around for what is best for passwords and I chose to use use a SHA512 hash(I know it isn't encryption, but still). Now a few weeks later I discover about SHA3. I hear this is more secure so implement it in my code. Reading on the tutorial on the SHA3 module I am using to add SHA3 to my code, I see there is such thing as SHAKE. With searching all I can find is Weed growing forums. So I want to know:

What is Shake? Is it like a SHA hash?

Is there an algorithm that is used to make hashes? Or are hashes made some other way?

Note: If you want to hash passwords, any SHA is a really bad choice. You really should use Argon2, scrypt, bcrypt or PBKDF2 (in that order). — SEJPM, Mar 22 '17 at 22:39
Also, SHA-3 is not "more secure" than SHA512 for use in a key derivation function — Richie Frame, Mar 23 '17 at 10:46
When you are suggesting the order, do you mean I should use all four? — Arthur Williams, Mar 23 '17 at 16:12
Note that typical collision resistant hashes like SHA3 or its SHAKE variants are not suitable for password hashing. See How to securely hash passwords?. — CodesInChaos, Mar 23 '17 at 16:17

score 4 · Accepted Answer · answered Mar 22 '17 at 23:16

What is SHAKE?

SHAKE is defined in FIPS 202 (PDF), it is a combination of SHA and KEccak (the original name of the candidate) by naming. What it does is that you give it an (arbitrarily long) input string and it returns you an (arbitrarily long) output string that has the usual properties of a hash (ie pseudo-randomness, collision-resistance, preimage-resistance, ...) while having a highly tunable length parameter which is useful in some applications.

Is it like a SHA hash?

It basically is SHA-3 (slightly different actually) but without the fixed length restrictions on the output.

Is there an algorithm that is used to make hashes? Or are hashes made some other way?

Technically speaking, you can use any hash algorithm to get hashes. Common choices include SHA3 and SHA-256 if you want something that is fast or Argon2, scrypt, bcrypt or PBKDF2 (in that order) if you want something that is slow.

As I can see from your question, you want to hash passwords. For this application, you really want to use slow hashes to slow an attacker down from trying all the passwords of your users quickly because they probably contain low uncertainity.

Good answer and a good read about Argon2, which I had not previously read about. Having no experience and foreknowledge about Argon2, would Argon2id be the recommended mode of operation? — Spencer D, Mar 23 '17 at 02:10
@SpencerDoak Argon2id was designed to be the middle-ground between the tradeoff-hardened Argon2d and the side-channel resistant Argon2i so yes it should "just work" if you can't make an informed decision for either of the others. — SEJPM, Mar 24 '17 at 01:19

Questions about SHA and SHAKE

1 Answers1