Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition

The National Institute of Standards and Technology (NIST) opened a public competition on November 2, 2007 to develop a new cryptographic hash algorithm – SHA-3, which will augment the hash algorithms currently specified in the Federal Information Processing Standard (FIPS) 180-3, Secure Hash Standard. The competition was NIST’s response to advances in the cryptanalysis of hash algorithms. NIST received sixty-four submissions in October 2008, and selected fifty-one candidate algorithms as the first-round candidates on December 10, 2008, and fourteen as the second-round candidates on July 24, 2009. One year was allocated for the public review of the second-round candidates. On December 9, 2010, NIST announced five SHA-3 finalists to advance to the third (and final) round of the competition. This report summarizes the evaluation and selection of the five finalists – BLAKE, Grostl, JH, Keccak and Skein.

[1]  Ji Li,et al.  Attacks on Round-Reduced BLAKE , 2009, IACR Cryptol. ePrint Arch..

[2]  Hirotaka Yoshida,et al.  A Study on RAM Requirements of Various SHA-3 Candidates on Low-cost 8-bit CPUs , 2009, IACR Cryptol. ePrint Arch..

[3]  John B. Shoven,et al.  I , Edinburgh Medical and Surgical Journal.

[4]  Ivica Nikolić.  Near Collisions for the Compression Function of Hamsi-256 , 2009 .

[5]  Christophe Clavier,et al.  Indifferentiability with Distinguishers: Why Shabal Does Not Require Ideal Ciphers , 2009, IACR Cryptol. ePrint Arch..

[6]  Vincent Rijmen,et al.  Rebound Attack on Reduced-Round Versions of JH , 2010, FSE.

[7]  Peter Novotney.  Distinguisher for Shabal's Permutation Function , 2010, IACR Cryptol. ePrint Arch..

[8]  Jean-Philippe Aumasson,et al.  Distinguisher for Full Final Round of Fugue-256 , 2010 .

[9]  Willi Meier,et al.  More on Shabal ’ s permutation , 2009 .

[10]  Meltem Sönmez Turan,et al.  Message Recovery and Pseudo-preimage Attacks on the Compression Function of Hamsi-256 , 2010, LATINCRYPT.

[11]  J. Leasure,et al.  Announcing request for candidate algorithm nominations for a new cryptographic hash algorithm (SHA-3 , 2007 .

[12]  Kasteelpark Arenberg,et al.  The Hash Function Hamsi , 2008 .

[13]  E. Biham,et al.  The SHAvite-3 Hash Function , 2008 .

[14]  Thomas Pornin.  Comparative Performance Review of the SHA-3 Second-Round Candidates , 2010 .

[15]  María Naya-Plasencia,et al.  Cryptanalysis of Luffa v2 Components , 2010, Selected Areas in Cryptography.

[16]  Kazuo Ohta,et al.  Evaluation of Hardware Performance for the SHA-3 Candidates Using SASEBO-GII , 2010, IACR Cryptol. ePrint Arch..

[17]  Orr Dunkelman,et al.  Attacks on Hash Functions Based on Generalized Feistel: Application to Reduced-Round Lesamnta and SHAvite-3512 , 2009, Selected Areas in Cryptography.

[18]  Dmitry Khovratovich,et al.  Cryptanalysis of Hash Functions with Structures , 2009, Selected Areas in Cryptography.

[19]  Shuang Wu,et al.  Near-Collisions on the Reduced-Round Compression Functions of Skein and BLAKE , 2010, CANS.

[20]  Gilles Brassard,et al.  Advances in Cryptology — CRYPTO’ 89 Proceedings , 2001, Lecture Notes in Computer Science.

[21]  Antoine Joux,et al.  Differential Collisions in SHA-0 , 1998, CRYPTO.

[22]  Keting Jia,et al.  Improved Related-Key Boomerang Attacks on Round-Reduced Threefish-512 , 2009, ISPEC.

[23]  Bart Preneel,et al.  Improved Collision Attacks on the Reduced-Round Grøstl Hash Function , 2010, ISC.

[24]  Thomas Peyrin,et al.  Improved Cryptanalysis of the Reduced Grøstl Compression Function, ECHO Permutation and AES Block Cipher , 2009, Selected Areas in Cryptography.

[25]  Xu Guo,et al.  Fair and Comprehensive Performance Evaluation of 14 Second Round SHA-3 ASIC Implementations , 2010 .

[26]  Joel Lathrop.  Cube attacks on cryptographic hash functions , 2009 .

[27]  Martin Schläffer.  Subspace Distinguisher for 5/8 Rounds of the ECHO-256 Hash Function , 2010, Selected Areas in Cryptography.

[28]  Jérémy Jean,et al.  Practical Near-Collisions and Collisions on Round-Reduced ECHO-256 Compression Function , 2010, IACR Cryptol. ePrint Arch..

[29]  Van Assche,et al.  A rotational distinguisher on Shabal ’ s keyed permutation and its impact on the security proofs , 2010 .

[30]  Anne Canteaut,et al.  A zero-sum property for the KECCAK-f permutation with 18 rounds , 2010, 2010 IEEE International Symposium on Information Theory.

[31]  A. H. Namin,et al.  Hardware Implementation of the Compression Function for Selected SHA-3 Candidates , 2009 .

[32]  Antoine Joux,et al.  Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions , 2004, CRYPTO.

[33]  Willi Meier,et al.  Improved Cryptanalysis of Skein , 2009, IACR Cryptol. ePrint Arch..

[34]  Yun-qiang Li,et al.  Near Collisions for the Compress Function of Hamsi-256 Found by Genetic Algorithm , 2010, IACR Cryptol. ePrint Arch..

[36]  G. G. Stokes.  "J." , 1890, The New Yale Book of Quotations.

[37]  Florian Mendel,et al.  Rebound Attacks on the Reduced Grøstl Hash Function , 2010, CT-RSA.

[38]  Gaëtan Leurent,et al.  Security Analysis of SIMD , 2010, IACR Cryptol. ePrint Arch..

[39]  Thomas Peyrin,et al.  Cryptanalysis of the 10-Round Hash and Full Compression Function of SHAvite-3-512 , 2010, AFRICACRYPT.

[40]  Mihir Bellare,et al.  Random oracles are practical: a paradigm for designing efficient protocols , 1993, CCS '93.

[41]  Stefan Lucks,et al.  The Skein Hash Function Family , 2009 .

[42]  Lars R. Knudsen,et al.  The Grindahl Hash Functions , 2007, FSE.

[43]  Shahram Khazaei,et al.  Improved Linear Differential Attacks on CubeHash , 2010, AFRICACRYPT.

[44]  Gaëtan Leurent,et al.  Practical Near-Collisions on the Compression Function of BMW , 2011, FSE.

[45]  Mohamed El-Hadedy,et al.  Cryptographic hash function Blue Midnight Wish , 2009, 2009 Proceedings of the 1st International Workshop on Security and Communication Networks.

[46]  Poorvi L. Vora,et al.  Pseudo-Linear Approximations for ARX Ciphers: With Application to Threefish , 2010, IACR Cryptol. ePrint Arch..

[47]  Martin Feldhofer,et al.  Uniform Evaluation of Hardware Implementations of the Round-Two SHA-3 Candidates , 2010 .

[48]  Martin Schläffer.  Improved Collisions for Reduced ECHO-256 , 2010, IACR Cryptol. ePrint Arch..

[49]  Stefan Lucks,et al.  Design Principles for Iterated Hash Functions , 2004, IACR Cryptol. ePrint Arch..

[50]  Willi Meier,et al.  SHA-3 proposal BLAKE , 2009 .

[51]  Thomas Peyrin,et al.  Inside the Hypercube , 2009, ACISP.

[52]  Bart Preneel,et al.  Finding collisions for reduced Luffa-256 v2 , 2011, ACISP 2011.

[53]  Florian Mendel,et al.  A Distinguisher for the Compression Function of SIMD-512 , 2009, INDOCRYPT.

[54]  Ivica Nikolic,et al.  Rotational Cryptanalysis of ARX , 2010, FSE.

[55]  Thomas Peyrin,et al.  Improved Differential Attacks for ECHO and Grostl , 2010, IACR Cryptol. ePrint Arch..

[56]  Willi Meier,et al.  Differential and invertibility properties of BLAKE (full version) , 2010, IACR Cryptol. ePrint Arch..

[57]  Guido Bertoni,et al.  On the Indifferentiability of the Sponge Construction , 2008, EUROCRYPT.

[58]  Enes Pasalic,et al.  Collisions for variants of the BLAKE hash function , 2010, Inf. Process. Lett..

[59]  Florian Mendel,et al.  Symmetric Cryptography , 2009 .

[60]  Florian Mendel,et al.  The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl , 2009, FSE.

[61]  Hongjun Wu,et al.  The Hash Function JH , 2009 .

[62]  Thomas Peyrin,et al.  Linearization Framework for Collision Attacks: Application to CubeHash and MD6 , 2009, ASIACRYPT.

[63]  Ivan Damgård,et al.  A Design Principle for Hash Functions , 1989, CRYPTO.

[64]  Takanori Isobe,et al.  Low-weight Pseudo Collision Attack on Shabal and Preimage Attack on Reduced Shabal-512 , 2010, IACR Cryptol. ePrint Arch..

[65]  Anne Canteaut,et al.  Higher-Order Differential Properties of Keccak and Luffa , 2011, FSE.

[66]  Mridul Nandi,et al.  Security Analysis of the Mode of JH Hash Function , 2010, FSE.

[67]  Elaine B. Barker,et al.  Report on the Development of the Advanced Encryption Standard (AES) , 2001, Journal of research of the National Institute of Standards and Technology.

[68]  Alfred Menezes,et al.  Handbook of Applied Cryptography , 2018 .

[69]  Deian Stefan,et al.  Performance Analysis of the SHA-3 Candidates on Exotic Multi-core Architectures , 2010, CHES.

[70]  D. Khovratovich,et al.  First Analysis of Keccak , 2009 .

[71]  Jean-Philippe Aumasson.  On the pseudorandomness of Shabal ’ s keyed permutation , 2009 .

[72]  G. V. Assche,et al.  Building power analysis resistant implementations of Keccak , 2010 .

[73]  Meltem Sönmez Turan,et al.  Practical Near-Collisions for Reduced Round Blake, Fugue, Hamsi and JH | NIST , 2010 .

[74]  Adi Shamir,et al.  An Improved Algebraic Attack on Hamsi-256 , 2011, FSE.

[75]  P. Schaumont,et al.  How Can We Conduct " Fair and Consistent " Hardware Evaluation for SHA-3 Candidate ? , 2010 .

[76]  William P. Marnane,et al.  FPGA Implementations of the Round Two SHA-3 Candidates , 2010, 2010 International Conference on Field Programmable Logic and Applications.

[77]  Søren S. Thomsen.  Pseudo-cryptanalysis of the Original Blue Midnight Wish , 2010, IACR Cryptol. ePrint Arch..

[78]  John Black,et al.  Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV , 2002, CRYPTO.

[79]  Søren S. Thomsen,et al.  Grindahl – a family of hash functions , 2007 .

[80]  G. V. Assche,et al.  Sponge Functions , 2007 .

[81]  Wei Wang,et al.  New Pseudo-Near-Collision Attack on Reduced-Round of Hamsi-256 , 2009, IACR Cryptol. ePrint Arch..

[82]  M. Anwar Hasan,et al.  Implementation of the compression function for selected SHA-3 candidates on FPGA , 2010, 2010 IEEE International Symposium on Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW).

[83]  Thomas Fuhr.  Finding Second Preimages of Short Messages for Hamsi-256 , 2010, ASIACRYPT.

[84]  Gaëtan Leurent.  Quantum Preimage and Collision Attacks on CubeHash , 2010, IACR Cryptol. ePrint Arch..

[85]  Olivier Billet , .

[86]  Orr Dunkelman,et al.  Linear Analysis of Reduced-Round CubeHash , 2011, ACNS.

[87]  Kris Gaj,et al.  Fair and Comprehensive Methodology for Comparing Hardware Performance of Fourteen Round Two SHA-3 Candidates Using FPGAs , 2010, CHES.

[88]  M. Bellare.  Provable Security Support for the Skein Hash Family Version 1 , 2009 .

[89]  Thomas Peyrin,et al.  Super-Sbox Cryptanalysis: Improved Attacks for AES-Like Permutations , 2010, FSE.

[90]  Yasuo Hatano,et al.  Higher Order Differential Attack on Step-Reduced Variants of Luffa v1 , 2010, FSE.

[91]  Willi Meier,et al.  Differential and Invertibility Properties of BLAKE , 2010, FSE.

[92]  Xiaoyun Wang,et al.  Cryptanalysis of the Compression Function of SIMD , 2011, ACISP.

[93]  Eli Biham,et al.  The SHAvite-3 - A New Hash Function , 2009, Symmetric Cryptography.

[94]  Niels Ferguson,et al.  Symmetric States and their Structure: Improved Analysis of CubeHash , 2010, IACR Cryptol. ePrint Arch..

[95]  Thomas Peyrin,et al.  Distinguishers for the Compression Function and Output Transformation of Hamsi-256 , 2010, ACISP.