NIST Interagency Report 7764 Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition Meltem Sönmez Turan Ray Perlner Lawrence E. Bassham William Burr Donghoon Chang Shu-jen Chang Morris J. Dworkin John M. Kelsey Souradyuti Paul Rene Peralta NIST Interagency Report 7764 Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition Meltem Sönmez Turan Ray Perlner Lawrence E . Bassham William Burr Donghoon Chang Shu-jen Chang Morris J. Dworkin John M. Kelsey Souradyuti Paul Rene Peralta C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 February 2011 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Director Abstract The National Institute of Standards and Technology (NIST) opened a public competition on November 2, 2007 to develop a new cryptographic hash algorithm – SHA-3, which will augment the hash algorithms currently specified in the Federal Information Processing Standard (FIPS) 180-3, Secure Hash Standard. The competition was NIST’s response to advances in the cryptanalysis of hash algorithms. NIST received sixty-four submissions in October 2008, and selected fifty-one candidate algorithms as the first-round candidates on December 10, 2008, and fourteen as the second-round candidates on July 24, 2009. One year was allocated for the public review of the second-round candidates. On December 9, 2010, NIST announced five SHA-3 finalists to advance to the third (and final) round of the competition. This report summarizes the evaluation and selection of the five finalists – BLAKE, Grøstl, JH, Keccak and Skein. KEY WORDS: Cryptographic hash algorithm; Cryptographic hash function; Cryptography; Cryptographic hash competition; SHA-3 competition. Acknowledgements NIST thanks the submitters of all fourteen second-round candidates. NIST is also grateful for the efforts of those in the cryptographic community that provided security, implementation and performance analyses of the candidate algorithms during the second round, including the eBASH and SHA-3 Zoo organizers, and those who provided feedback on the hash forum or published papers on the various technical aspects of the candidates. The authors of this report also thank the other members of NIST’s SHA-3 team, who reviewed the candidate algorithms and the public comments; performed testing; provided technical and administrative support; and participated in numerous meetings to discuss the selection of the finalists. They are: Elaine Barker, Sara J. Caswell, Lily Chen, Quynh Dang, James Nechvatal and Andrew Regenscheid. iii TABLE OF CONTENTS 1. Introduction ...................................................................................................................... 1 1.1 Purpose of this Document......................................................................................... 1 1.2 Background .............................................................................................................. 1 1.3 Organization of this Document .................................................................................. 3 2. Evaluation Criteria ............................................................................................................ 3 3. Selection Process ............................................................................................................. 5 4. Summary of the Second-Round Candidates .................................................................. 6 4.1 BLAKE ...................................................................................................................... 7 4.1.1 Security ......................................................................................................... 7 4.1.2 Performance .................................................................................................. 8 4.1.3 Discussion ..................................................................................................... 8 4.2 Blue Midnight Wish ................................................................................................... 8 4.2.1 Security ......................................................................................................... 8 4.2.2 Performance .................................................................................................. 9 4.2.3 Discussion ..................................................................................................... 9 4.3 CubeHash ................................................................................................................ 9 4.3.1 Security ....................................................................................................... 10 4.3.2 Performance ................................................................................................ 11 4.3.3 Discussion ................................................................................................... 12 4.4 ECHO ..................................................................................................................... 12 4.4.1 Security ....................................................................................................... 12 4.4.2 Performance ................................................................................................ 13 4.4.3 Discussion ................................................................................................... 13 4.5 Fugue ..................................................................................................................... 13 4.5.1 Security ....................................................................................................... 13 4.5.2 Performance ................................................................................................ 14 4.5.3 Discussion ................................................................................................... 14 4.6 Grøstl ..................................................................................................................... 14 4.6.1 Security ....................................................................................................... 14 4.6.2 Performance ................................................................................................ 15 4.6.3 Discussion ................................................................................................... 15 4.7 Hamsi ..................................................................................................................... 15 4.7.1 Security ....................................................................................................... 16 4.7.2 Performance ................................................................................................ 16 4.7.3 Discussion ................................................................................................... 17 4.8 JH ........................................................................................................................... 17 4.8.1 Security ....................................................................................................... 17 4.8.2 Performance ................................................................................................ 17 4.8.3 Discussion ................................................................................................... 18 iv 4.9 Keccak ................................................................................................................... 18 4.9.1 Security ....................................................................................................... 18 4.9.2 Performance ................................................................................................ 18 4.9.3 Discussion ................................................................................................... 19 4.10 Luffa ....................................................................................................................... 19 4.10.1 Security ....................................................................................................... 19 4.10.2 Performance ................................................................................................ 19 4.10.3 Discussion ................................................................................................... 20 4.11 Shabal .................................................................................................................... 20 4.11.1 Security ....................................................................................................... 20 4.11.2 Performance ................................................................................................ 21 4.11.3 Discussion ................................................................................................... 21 4.12 SHAvite-3 ............................................................................................................... 21 4.12.1 Security ....................................................................................................... 22 4.12.2 Performance ................................................................................................ 22 4.12.3 Discussion ................................................................................................... 22 4.13 SIMD .....................................................................................................................