NIST hash function competition

The NIST hash function competition is an open competition held by the US National Institute of Standards and Technology for a new SHA-3 function to replace the older SHA-1 and SHA-2, which was formally announced in the Federal Register on November 2, 2007.^[1] "NIST is initiating an effort to develop one or more additional hash algorithms through a public competition, similar to the development process for the Advanced Encryption Standard (AES)."^[2]

Submissions were due October 31, 2008, with a list of candidates accepted for the first round published December 9, 2008.^[3] NIST held a conference in late February 2009 where submitters gave presentations on their algorithms and NIST officials discussed criteria for narrowing down the field of candidates for Round 2.^[4] The list of 14 candidates accepted to Round 2 was published on July 24, 2009.^[5] Another conference was held August 23-24, 2010 (after CRYPTO 2010) at the University of California, Santa Barbara, where the second-round candidates were discussed.^[6] The announcement of the final round candidates occurred on December 10, 2010 and the proclamation of a winner and publication of the new standard are scheduled to take place in 2012.^[7]

Contents 1 Entrants 1.1 Finalists 1.2 Did not pass to Final Round 1.3 Did not pass to Round Two 1.3.1 Entrants with substantial weaknesses 1.3.2 Conceded entrants 1.4 Rejected entrants 2 References 3 External links

Entrants

This is an incomplete list of known submissions. NIST selected 51 entries for the Round 1.^[3] 14 of them advanced to Round 2,^[5] from which 5 finalists were selected.

Finalists

NIST has selected five SHA-3 candidate algorithms to advance to the third (and final) round ^[8]:

• BLAKE
• Grøstl (Knudsen et al.)
• JH
• Keccak (Keccak team, Daemen et al.)
• Skein (Schneier et al.)

NIST noted some factors that figured into its selection as it announced the finalists:^[9]

• Performance: "A couple of algorithms were wounded or eliminated by very large [hardware gate] area requirement – it seemed that the area they required precluded their use in too much of the potential application space."
• Security: "We preferred to be conservative about security, and in some cases did not select algorithms with exceptional performance, largely because something about them made us 'nervous,' even though we knew of no clear attack against the full algorithm."
• Analysis: "NIST eliminated several algorithms because of the extent of their second-round tweaks or because of a relative lack of reported cryptanalysis – either tended to create the suspicion that the design might not yet be fully tested and mature."
• Diversity: The finalists included hashes based on different modes of operation, including the HAIFA and sponge hash constructions, and with different internal structures, including ones based on AES, bitslicing, and alternating XOR with addition.

NIST has released a report explaining its evaluation algorithm-by-algorithm.^[10]

Did not pass to Final Round

The following hash function submissions were accepted for Round Two, but did not make it to the final round. As noted in the announcement of the finalists, "none of these candidates was clearly broken".

Did not pass to Round Two

The following hash function submissions were accepted for Round One but did not pass to Round Two. They have neither been conceded by the submitters nor have had substantial cryptographic weaknesses. However, most of them have some weaknesses in the design components, or performance issues.

Entrants with substantial weaknesses

The following non-conceded Round One entrants have had substantial cryptographic weaknesses announced.

Conceded entrants

The following Round One entrants have been officially retracted from the competition by their submitters; they are considered broken according to the NIST official Round One Candidates web site. As such, they are withdrawn from the competition.

Rejected entrants

Several submissions received by NIST were not accepted as First Round Candidates, following an internal review by NIST.^[3] In general, NIST gave no details as to why each was rejected. NIST also has not given a comprehensive list of rejected algorithms; there are known to be 13,^[3][63] but only the following are public.

References

External links

• NIST website for competition
• Official list of second round candidates
• Official list of first round candidates
• SHA-3 Zoo
• Classification of the SHA-3 Candidates
• Hash Function Lounge
• A VHDL source codes developed in the Cryptographic Engineering Research Group (CERG) at George Mason University

Cryptographic hash functions and message authentication codes (MACs) Common functions MD5 · SHA-1 · SHA-2 Functions FSB · SHA-3 · ECOH · GOST · HAS-160 · HAVAL · LM hash · MDC-2 · MD2 · MD4 · N-Hash · RadioGatún · RIPEMD · Snefru · SWIFFT · Tiger · VSH · WHIRLPOOL · crypt(3) (DES) SHA-3 finalists BLAKE · Grøstl · JH · Keccak · Skein MAC algorithms DAA · CBC-MAC · HMAC · OMAC/CMAC · PMAC · VMAC · UMAC · Poly1305-AES Authenticated encryption modes CCM · CWC · EAX · GCM · IAPM · OCB Attacks Collision attack · Preimage attack · Birthday attack · Brute force attack · Rainbow table · Distinguishing attack · Side-channel attack Misc. Avalanche effect · Hash collision · Merkle–Damgård construction · Salt Standardization CRYPTREC · NESSIE · NIST hash function competition   Cryptography History of cryptography · Cryptanalysis · Cryptography portal · Outline of cryptography Symmetric-key algorithm · Block cipher · Stream cipher · Public-key cryptography · Cryptographic hash function · Message authentication code · Random numbers · Steganography