Secure Hash Algorithm-3 (SHA-3) family

references:

1. Bertoni G, Daemen J, Peeters M, et al. Keccak[C]//Advances in Cryptology–EUROCRYPT 2013: 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Athens, Greece, May 26-30, 2013. Proceedings 32. Springer Berlin Heidelberg, 2013: 313-314.
2. Dworkin M J. SHA-3 standard: Permutation-based hash and extendable-output functions[J]. 2015.

On October 2, 2012, Keccak was selected as the winner of the NIST (National Institute of Standards and Technology) hash function competition. SHA-3 is not intended to replace SHA-2, because SHA-2 does not exhibit significant weaknesses. Due to the successful cracking of MD5 and SHA-1, NIST felt the need for an alternative cryptographic hash algorithm to the previous one, namely SHA-3.

permutation function

$KECCAK-p[b,n_r]$ permutation function, where$n_r$is the number of rounds (round), and b ∈ { 25 , 50 , 100 , 200 , 400 , 800 , 1600 } b \in \{25,50,100,200,400,800,1600\}b∈{ 25,50,100,200,400,800,1600 } is the width (width)

The state state is of size $5\times 5\times The\; three-dimensional\; array\; of\; w$ , its two-dimensional sub-arrays are calledsheets, planes, slices, and the one-dimensional sub-arrays are calledrows, columns, lanes.

$KECCAK-p[b,n_r]$ include$n_r$iterations, in each iteration the state array $A$ derivative$i,r,p,x,i$ transform，
$$Rnd(A,i_r)=y\left(x\right(\pi \left(\rho \right(\theta (A)))),i_r)$$

I have not explored the specific transformations. Readers who are interested can check the SHA-3 standard document by themselves.

Also define
$$KECCAK-f[b]=KECCAK-p[b,12+2l]$$

In particular, $KECCAK-f[1600]=KECCAK-p[1600,24]$

sponge structure

Sponge construction includes two steps of absorption (sbsorbing) and squeezing (squeezing), defined as $SPONGE[f,pad,r](N,d)$，

• Fixed-length permutation function $f$
• Ratio (rate) $r<b$ , and$c=b-r$ is called capacity
• fill rule $pad$
• Input bitstream $N$
• Output bit length $d$

As shown in the figure, in the absorption stage, the input bit stream $N$ is divided into rrafter padding$Several\; blocks\; of\; length\; r$ are XORed with the link variable and used as the input of the replacement function; in the extrusion stage, the link variable is directly used as the input each time, and the output link variable is intercepted by$r$ bits as an output block (block); finally, intercept$A\; prefix\; of\; d$ bits is used as the final output.

KECCAK is a family of $KECCAK-$The sponge structure under$f$$[$$b$$]$$pad10^{\ast }1$(i.e. filling$1\Vert 0\cdots 0\; \Vert \; 1$ bit string). its$b$ can be from{ 25 , 50 , 100 , 200 , 400 , 800 , 1600 } \{25,50,100,200,400,800,1600\}{ 25,50,100,200,400,800,1600 } , if you set$b=1600$ Then there is:
$$KECCAK[c](N,d)=SPONGE[KECCAK-p[1600,24],pad10^{\ast }1,1600-c](N,d)$$

Hash & XOF

Cryptographic hash functions : SHA3-224, SHA3-256, SHA3-384, SHA3-512.

Use the KECCAK function and set $c=2d$ , then set$N=M\Vert 01$ (two-bit suffix),

• $\text{SHA3-224}\left(M\right)=KECCAK\left[448\right](M\Vert 01,224)$ , the length of the digest is$224$ bits
• $\text{SHA3-256}\left(M\right)=KECCAK\left[512\right](M\Vert 01,256)$ , the length of the digest is$256$ bits
• $\text{SHA3-384}\left(M\right)=KECCAK\left[768\right](M\Vert 01,384)$ , the length of the digest is$384$ bits
• $\text{SHA3-512}\left(M\right)=KECCAK\left[1024\right](M\Vert 01,512)$ , the length of the digest is$512$ bits

Extensible output functions (extendable-output functions, XOF ): SHAKE128, SHAKE256.

Use the KECCAK function and set $N=M\Vert 1111$ (four-bit suffix),

• $\text{SHAKE128}(M,d)=KECCAK\left[256\right](M\Vert \; 1111,d)$ , the parameters are$b=1600,c=256$ , the block length of each output is$r=1344$ bits
• $\text{SHAKE256}(M,d)=KECCAK\left[512\right](M\Vert \; 1111,d)$ , the parameters are$b=1600,c=512$ , the block length of each output is$r=1088$ bits