SHA-3, also known as Keccak, is a cryptographic hash function standardized by NIST as a new alternative to the SHA-2 hash function family.
SHA-3, also known as Keccak, is a cryptographic hash function selected by NIST as an alternative to the SHA-2 hash function family.
The Keccak sponge function family was designed by Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche, and was submitted to the NIST SHA-3 hash function competition in 2008. Its design is based on the earlier hash functions Panama and RadioGatún, and uses the cryptographic sponge construction.
On October 2, 2012, from among the five finalists of the SHA-3 competition (Blake, Grøstl, JH, Keccak and Skein), NIST selected Keccak as the new SHA-3 hash standard, which is expected to be published in the second quarter of 2014. The SHA-3 hash function does not replace the existing SHA-2 hash functions (SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256), which are still recommended by NIST, but rather complements them. According to the SHA-3 selection announcement:
"NIST chose KECCAK over the four other excellent finalists for its elegant design, large security margin, good general performance, excellent efficiency in hardware implementations, and for its flexibility. KECCAK uses a new “sponge construction” chaining mode, based on a fixed permutation, that can readily be adjusted to trade generic security strength for throughput, and can generate larger or smaller hash outputs as required. The KECCAK designers have also defined a modified chaining mode for KECCAK that provides authenticated encryption.
Additionally, KECCAK complements the existing SHA-2 family of hash algorithms well. NIST remains confident in the security of SHA-2 which is now widely implemented, and the SHA-2 hash algorithms will continue to be used for the foreseeable future, as indicated in the NIST hash policy statement. One benefit that KECCAK offers as the SHA-3 winner is its difference in design and implementation properties from that of SHA-2. It seems very unlikely that a single new cryptanalytic attack or approach could threaten both algorithms. Similarly, the very different implementation properties of the two algorithms will allow future application and protocol designers greater flexibility in finding one of the two hash algorithms that fits well with their requirements."
See also:
- sha-2 (including sha256 and sha512)
- sha-3-competition
- hash
