Difference between revisions of "Template:Comparison of SHA functions"

From blackwiki
Jump to navigation Jump to search
(Add quote to citation supporting unlimited MD5 length. The actual padding is identical to SHA-0/1. Maybe just delete "max message size" column? It's never a practical limitation.)
imported>Vecr
(Added note on length extension attack. I'm not sure of the requirements on citations in a template like this.)
 
(32 intermediate revisions by 18 users not shown)
Line 2: Line 2:
 
|+ Comparison of SHA functions {{Navbar|Comparison of SHA functions|plain=1|style=float:right}}
 
|+ Comparison of SHA functions {{Navbar|Comparison of SHA functions|plain=1|style=float:right}}
 
|- style="vertical-align:bottom;"
 
|- style="vertical-align:bottom;"
! colspan="2" | Algorithm and variant
+
! colspan="2" rowspan="2" | Algorithm and variant
! Output size<br/>(bits)
+
! rowspan="2" | Output size<br/>(bits)
! Internal state size<br/>(bits)
+
! rowspan="2" | Internal state size<br/>(bits)
! Block size<br/>(bits)
+
! rowspan="2" | Block size<br/>(bits)
! Max message size<br/>(bits)
+
! rowspan="2" | Rounds
! Rounds
+
! rowspan="2" | Operations
! Operations
+
! rowspan="2" | Security (in{{nbsp}}bits) against [[collision attack]]s
! Security bits<br/>(Info)
+
! rowspan="2" | Capacity<br/>against [[length extension attack]]s
! Example performance{{refn|Found on an [[AMD Opteron]] 8354 2.2 GHz processor running 64-bit Linux<ref>{{cite web
+
! colspan="2" | Performance on [[Skylake (microarchitecture)|Skylake]] (median [[cycles per byte|cpb]])<ref>{{cite web |url=http://bench.cr.yp.to/results-hash.html#amd64-skylake |title=Measurements table|website=bench.cr.yp.to}}</ref>
| url=http://www.cryptopp.com/benchmarks-amd64.html
+
! rowspan="2" | First published
| title=Crypto++ 5.6.0 Benchmarks
+
|- style="vertical-align:bottom;"
| accessdate=2013-06-13 }}
+
! long messages !! 8 bytes
</ref>}}<br/>([[Mebibyte|MiB]]/s)
 
! First Published
 
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| colspan="2" | '''[[MD5]]''' (as reference) || 128 || 128<br>{{nowrap|(4 × 32)}} || 512 || Unlimited<ref>{{cite web|url=http://tools.ietf.org/html/rfc1321 |title=The MD5 Message-Digest Algorithm |date= |accessdate=2016-04-18 |quote=In the unlikely event that b is greater than 2^64, then only the low-order 64 bits of b are used.}}</ref> || 64 || And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>32</sup>),}} Or || {{Bad|&lt;64<br/>(collisions found)}} || 335 || 1992
+
| colspan="2" | '''[[MD5]]''' (as reference) || 128 || 128<br>{{nowrap|(4 × 32)}} || 512 || 64 || And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>32</sup>),}} Or || {{Bad|≤18<br/>(collisions found)<ref>{{Cite techreport|first1=Xie|last1=Tao|first2=Fanbao|last2=Liu|first3=Dengguo|last3=Feng|year=2013|title=Fast Collision Attack on MD5|work=Cryptology ePrint Archive|publisher=[[International Association for Cryptologic Research|IACR]]|url=https://eprint.iacr.org/2013/170.pdf}}</ref>}} || {{Bad|0}}|| 4.99 || 55.00 || 1992
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| colspan="2" | '''{{nowrap|[[SHA-0]]}}''' || 160 || 160<br>{{nowrap|(5 × 32)}} || 512 || 2<sup>64</sup> − 1|| 80 || rowspan="2" | And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>32</sup>),}} Or || {{Bad|&lt;34<br/>(collisions found)}}  || - || 1993
+
| colspan="2" | '''{{nowrap|[[SHA-0]]}}''' || rowspan="2" | 160 || rowspan="2" | 160<br>{{nowrap|(5 × 32)}} || rowspan="2" | 512 || rowspan="2" | 80 || rowspan="2" | And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>32</sup>),}} Or || {{Bad|&lt;34<br/>(collisions found)}}  || rowspan="2"  {{Bad|0}} || ≈ SHA-1 || ≈ SHA-1 || 1993
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| colspan="2" | '''{{nowrap|[[SHA-1]]}}''' || 160 || 160<br>{{nowrap|(5 × 32)}} || 512 || 2<sup>64</sup> − 1 || 80 || {{Bad|&lt;63<br/>(collisions found<ref>{{cite web|url=https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html |title=Announcing the first SHA1 collision |date= |accessdate=2017-02-23}}</ref>)}} || 192 || 1995
+
| colspan="2" | '''{{nowrap|[[SHA-1]]}}''' || {{Bad|&lt;63<br/>(collisions found)<ref>{{Cite techreport|last1=Stevens|first1=Marc|author-link1=Marc Stevens (cryptology)|last2=Bursztein|first2=Elie|author-link2=Elie Bursztein|last3=Karpman|first3=Pierre|last4=Albertini|first4=Ange|last5=Markov|first5=Yarik|title=The first collision for full SHA-1|publisher=[[Google|Google Research]]|url=https://shattered.io/static/shattered.pdf|lay-url=https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html|lay-source=Google Security Blog|lay-date=February 23, 2017}}</ref>}} || 3.47 || 52.00 || 1995
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| rowspan="2" | '''{{nowrap|[[SHA-2]]}}''' || ''SHA-224''<br/>''SHA-256'' || 224<br/>256 || 256<br/>{{nowrap|(8 × 32)}} || 512 || 2<sup>64</sup> − 1 || 64 || And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>32</sup>),}} Or, Shr || {{Good|112 <br/> 128}} || 139 || 2001
+
| rowspan="3" | '''{{nowrap|[[SHA-2]]}}''' || ''SHA-224''<br/>''SHA-256'' || 224<br/>256 || 256<br/>{{nowrap|(8 × 32)}} || 512 || 64 || And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>32</sup>),}} Or, Shr || {{Good|112 <br/> 128}} || {{Bad|32<br/>0}}|| 7.62<br/>7.63 || 84.50<br/>85.25 || 2004<br/>2001
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| ''SHA-384''<br/>''SHA-512''<br/>''{{nowrap|SHA-512/224}}''<br/>''{{nowrap|SHA-512/256}}'' ||  384<br/>512<br/>224 <br/>256 || 512<br/>{{nowrap|(8 × 64)}} || 1024 || 2<sup>128</sup> − 1 || 80 || And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>64</sup>),}} Or, Shr || {{Good|192<br/>256<br/>112<br/>128}} || 154 || 2001
+
| ''SHA-384''<br/>''SHA-512'' ||  384<br/>512 || rowspan="2" | 512<br/>{{nowrap|(8 × 64)}} || rowspan="2" | 1024 || rowspan="2" | 80  || rowspan="2" | And, Xor, Rot, {{nowrap|Add (mod&nbsp;2<sup>64</sup>),}} Or, Shr || {{Good|192<br/>256}} || {{Bad|{{nowrap|128 (&le; 384)}}<br/>0<ref>Without truncation, the full internal state of the hash function is known, regardless of collision resistance. If the output is truncated, the removed part of the state must be searched for and found before the hash function can be resumed, allowing the attack to proceed.</ref> }} || 5.12<br/>5.06 || 135.75<br/>135.50 |2001
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| rowspan="2" | '''{{nowrap|[[SHA-3]]}}''' || ''SHA3-224''<br/>''SHA3-256''<br/>''SHA3-384''<br/>''SHA3-512'' || 224<br/>256<br/>384<br/>512 || rowspan="2" | 1600<br>{{nowrap|(5 × 5 × 64)}} || 1152<br/>1088<br/>832<br/>576 || rowspan="2" | Unlimited<ref>{{cite web|url=http://sponge.noekeon.org/ |title=The Sponge Functions Corner |date= |accessdate=2016-01-27}}</ref>|| rowspan="2" | 24<ref>{{cite web|url=http://keccak.noekeon.org/specs_summary.html |title=The Keccak sponge function family |date= |accessdate=2016-01-27}}</ref> || rowspan="2" | And, Xor, Rot, Not  || {{Good|112<br/>128<br/>192<br/>256}} || - || 2015
+
| ''{{nowrap|SHA-512/224}}''<br/>''{{nowrap|SHA-512/256}}'' || 224<br/>256 || {{Good|112<br/>128}} || {{Good|288<br/>256}} || {{nowrap|≈ SHA-384}} || {{nowrap|≈ SHA-384}} || 2012
 
|- style="text-align:center;vertical-align:top;"
 
|- style="text-align:center;vertical-align:top;"
| ''SHAKE128''<br/>''SHAKE256'' || {{nowrap|''d'' (arbitrary)}}<br/>{{nowrap|''d'' (arbitrary)}} || 1344<br/>1088 || {{Good|min(''d''/2, 128)<br/>min(''d''/2, 256)}} || - || 2015
+
| rowspan="2" | '''{{nowrap|[[SHA-3]]}}''' || ''SHA3-224''<br/>''SHA3-256''<br/>''SHA3-384''<br/>''SHA3-512'' || 224<br/>256<br/>384<br/>512 || rowspan="2" | 1600<br>{{nowrap|(5 × 5 × 64)}} || 1152<br/>1088<br/>832<br/>576 || rowspan="2" | {{nowrap|24}}<ref>{{cite web|url=http://keccak.noekeon.org/specs_summary.html |title=The Keccak sponge function family |date= |accessdate=2016-01-27}}</ref> || rowspan="2" | And, Xor, Rot, Not  || {{Good|112<br/>128<br/>192<br/>256}} ||{{Good|448<br/>512<br/>768<br/>1024}}|| 8.12<br/>8.59<br/>11.06<br/>15.88 ||154.25<br/>155.50<br/>164.00<br/>164.00 || rowspan="2" | 2015
 +
|- style="text-align:center;vertical-align:top;"
 +
| ''SHAKE128''<br/>''SHAKE256'' || {{nowrap|''d'' (arbitrary)}}<br/>{{nowrap|''d'' (arbitrary)}} || 1344<br/>1088 || {{Good|min(''d''/2, 128)<br/>{{nowrap|min(''d''/2, 256)}}}} || {{Good|{{nowrap|256<br/>512}}}} || 7.08<br/>8.59 || 155.25<br/>155.50
 
|}<noinclude>
 
|}<noinclude>
 
 
{{Template reference list}}
 
{{Template reference list}}
 
</noinclude>
 
</noinclude>

Latest revision as of 07:17, 18 October 2020

Comparison of SHA functions

Algorithm and variant Output size
(bits)
Internal state size
(bits)
Block size
(bits)
Rounds Operations Security (in bits) against collision attacks Capacity
against length extension attacks
Performance on Skylake (median cpb)[1] First published
long messages 8 bytes
MD5 (as reference) 128 128
(4 × 32)
512 64 And, Xor, Rot, Add (mod 232), Or ≤18
(collisions found)[2]
0 4.99 55.00 1992
SHA-0 160 160
(5 × 32)
512 80 And, Xor, Rot, Add (mod 232), Or <34
(collisions found)
0 ≈ SHA-1 ≈ SHA-1 1993
SHA-1 <63
(collisions found)[3]
3.47 52.00 1995
SHA-2 SHA-224
SHA-256
224
256
256
(8 × 32)
512 64 And, Xor, Rot, Add (mod 232), Or, Shr 112
128
32
0
7.62
7.63
84.50
85.25
2004
2001
SHA-384
SHA-512
384
512
512
(8 × 64)
1024 80 And, Xor, Rot, Add (mod 264), Or, Shr 192
256
128 (≤ 384)
0[4]
5.12
5.06
135.75
135.50
2001
SHA-512/224
SHA-512/256
224
256
112
128
288
256
≈ SHA-384 ≈ SHA-384 2012
SHA-3 SHA3-224
SHA3-256
SHA3-384
SHA3-512
224
256
384
512
1600
(5 × 5 × 64)
1152
1088
832
576
24[5] And, Xor, Rot, Not 112
128
192
256
448
512
768
1024
8.12
8.59
11.06
15.88
154.25
155.50
164.00
164.00
2015
SHAKE128
SHAKE256
d (arbitrary)
d (arbitrary)
1344
1088
min(d/2, 128)
min(d/2, 256)
256
512
7.08
8.59
155.25
155.50

References

  1. "Measurements table". bench.cr.yp.to.
  2. Tao, Xie; Liu, Fanbao; Feng, Dengguo (2013). Fast Collision Attack on MD5 (PDF). Cryptology ePrint Archive (Technical report). IACR.
  3. Stevens, Marc; Bursztein, Elie; Karpman, Pierre; Albertini, Ange; Markov, Yarik. The first collision for full SHA-1 (PDF) (Technical report). Google Research. Lay summaryGoogle Security Blog (February 23, 2017).
  4. Without truncation, the full internal state of the hash function is known, regardless of collision resistance. If the output is truncated, the removed part of the state must be searched for and found before the hash function can be resumed, allowing the attack to proceed.
  5. "The Keccak sponge function family". Retrieved 2016-01-27.