Difference between revisions of "Template:Comparison of SHA functions"
Jump to navigation
Jump to search
imported>DannyS712 m (Reverted edits by 2A00:1FA0:8675:1C42:0:5E:7B21:2A01 (talk) to last version by Trappist the monk) |
imported>Vecr (Added note on length extension attack. I'm not sure of the requirements on citations in a template like this.) |
||
| Line 23: | Line 23: | ||
| rowspan="3" | '''{{nowrap|[[SHA-2]]}}''' || ''SHA-224''<br/>''SHA-256'' || 224<br/>256 || 256<br/>{{nowrap|(8 × 32)}} || 512 || 64 || And, Xor, Rot, {{nowrap|Add (mod 2<sup>32</sup>),}} Or, Shr || {{Good|112 <br/> 128}} || {{Bad|32<br/>0}}|| 7.62<br/>7.63 || 84.50<br/>85.25 || 2004<br/>2001 | | rowspan="3" | '''{{nowrap|[[SHA-2]]}}''' || ''SHA-224''<br/>''SHA-256'' || 224<br/>256 || 256<br/>{{nowrap|(8 × 32)}} || 512 || 64 || And, Xor, Rot, {{nowrap|Add (mod 2<sup>32</sup>),}} Or, Shr || {{Good|112 <br/> 128}} || {{Bad|32<br/>0}}|| 7.62<br/>7.63 || 84.50<br/>85.25 || 2004<br/>2001 | ||
|- style="text-align:center;vertical-align:top;" | |- style="text-align:center;vertical-align:top;" | ||
| − | | ''SHA-384''<br/>''SHA-512'' || 384<br/>512 || rowspan="2" | 512<br/>{{nowrap|(8 × 64)}} || rowspan="2" | 1024 || rowspan="2" | 80 || rowspan="2" | And, Xor, Rot, {{nowrap|Add (mod 2<sup>64</sup>),}} Or, Shr || {{Good|192<br/>256}} || {{Bad|{{nowrap|128 (≤ 384)}}<br/>0}} || 5.12<br/>5.06 || 135.75<br/>135.50 || 2001 | + | | ''SHA-384''<br/>''SHA-512'' || 384<br/>512 || rowspan="2" | 512<br/>{{nowrap|(8 × 64)}} || rowspan="2" | 1024 || rowspan="2" | 80 || rowspan="2" | And, Xor, Rot, {{nowrap|Add (mod 2<sup>64</sup>),}} Or, Shr || {{Good|192<br/>256}} || {{Bad|{{nowrap|128 (≤ 384)}}<br/>0<ref>Without truncation, the full internal state of the hash function is known, regardless of collision resistance. If the output is truncated, the removed part of the state must be searched for and found before the hash function can be resumed, allowing the attack to proceed.</ref> }} || 5.12<br/>5.06 || 135.75<br/>135.50 || 2001 |
|- style="text-align:center;vertical-align:top;" | |- style="text-align:center;vertical-align:top;" | ||
| ''{{nowrap|SHA-512/224}}''<br/>''{{nowrap|SHA-512/256}}'' || 224<br/>256 || {{Good|112<br/>128}} || {{Good|288<br/>256}} || {{nowrap|≈ SHA-384}} || {{nowrap|≈ SHA-384}} || 2012 | | ''{{nowrap|SHA-512/224}}''<br/>''{{nowrap|SHA-512/256}}'' || 224<br/>256 || {{Good|112<br/>128}} || {{Good|288<br/>256}} || {{nowrap|≈ SHA-384}} || {{nowrap|≈ SHA-384}} || 2012 | ||
Latest revision as of 07:17, 18 October 2020
| Algorithm and variant | Output size (bits) |
Internal state size (bits) |
Block size (bits) |
Rounds | Operations | Security (in bits) against collision attacks | Capacity against length extension attacks |
Performance on Skylake (median cpb)[1] | First published | ||
|---|---|---|---|---|---|---|---|---|---|---|---|
| long messages | 8 bytes | ||||||||||
| MD5 (as reference) | 128 | 128 (4 × 32) |
512 | 64 | And, Xor, Rot, Add (mod 232), Or | ≤18 (collisions found)[2] |
0 | 4.99 | 55.00 | 1992 | |
| SHA-0 | 160 | 160 (5 × 32) |
512 | 80 | And, Xor, Rot, Add (mod 232), Or | <34 (collisions found) |
0 | ≈ SHA-1 | ≈ SHA-1 | 1993 | |
| SHA-1 | <63 (collisions found)[3] |
3.47 | 52.00 | 1995 | |||||||
| SHA-2 | SHA-224 SHA-256 |
224 256 |
256 (8 × 32) |
512 | 64 | And, Xor, Rot, Add (mod 232), Or, Shr | 112 128 |
32 0 |
7.62 7.63 |
84.50 85.25 |
2004 2001 |
| SHA-384 SHA-512 |
384 512 |
512 (8 × 64) |
1024 | 80 | And, Xor, Rot, Add (mod 264), Or, Shr | 192 256 |
128 (≤ 384) 0[4] |
5.12 5.06 |
135.75 135.50 |
2001 | |
| SHA-512/224 SHA-512/256 |
224 256 |
112 128 |
288 256 |
≈ SHA-384 | ≈ SHA-384 | 2012 | |||||
| SHA-3 | SHA3-224 SHA3-256 SHA3-384 SHA3-512 |
224 256 384 512 |
1600 (5 × 5 × 64) |
1152 1088 832 576 |
24[5] | And, Xor, Rot, Not | 112 128 192 256 |
448 512 768 1024 |
8.12 8.59 11.06 15.88 |
154.25 155.50 164.00 164.00 |
2015 |
| SHAKE128 SHAKE256 |
d (arbitrary) d (arbitrary) |
1344 1088 |
min(d/2, 128) min(d/2, 256) |
256 512 |
7.08 8.59 |
155.25 155.50 | |||||
References
- ↑ "Measurements table". bench.cr.yp.to.
- ↑ Tao, Xie; Liu, Fanbao; Feng, Dengguo (2013). Fast Collision Attack on MD5 (PDF). Cryptology ePrint Archive (Technical report). IACR.
- ↑ Stevens, Marc; Bursztein, Elie; Karpman, Pierre; Albertini, Ange; Markov, Yarik. The first collision for full SHA-1 (PDF) (Technical report). Google Research. Lay summary – Google Security Blog (February 23, 2017).
- ↑ Without truncation, the full internal state of the hash function is known, regardless of collision resistance. If the output is truncated, the removed part of the state must be searched for and found before the hash function can be resumed, allowing the attack to proceed.
- ↑ "The Keccak sponge function family". Retrieved 2016-01-27.
