The ECRYPT Hash Function Website - User contributions [en]

Hamsi

2010-12-06T11:45:16Z

SThomsen:

== The algorithm ==

* Author(s): Özgül Kücük
* Website: [http://homes.esat.kuleuven.be/~okucuk/hamsi/ http://homes.esat.kuleuven.be/~okucuk/hamsi/]
* NIST submission package:
**round 1/2: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Hamsi_Round2.zip Hamsi_Round2.zip] (old versions: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Hamsi.zip Hamsi.zip], [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/HamsiUpdate.zip HamsiUpdate.zip])

<bibtex>
@misc{sha3Kucuk09,
author = {Özgül Küçük},
title = {The Hash Function Hamsi},
url = {http://www.cosic.esat.kuleuven.be/publications/article-1203.pdf},
howpublished = {Submission to NIST (updated)},
year = {2009},
}
</bibtex>

<bibtex>
@misc{sha3Kucuk08,
author = {Özgül Küçük},
title = {The Hash Function Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/9/95/Hamsi.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

We distinguish between two cases: results on the complete hash function, and results on underlying building blocks.

A description of the tables is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

Recommended security parameters: '''(3,6)''' P,Pf rounds (n=224,256); '''(6,12)''' P,Pf rounds (n=384,512).

=== Hash function ===

Here we list results on the actual hash function. The only allowed modification is to change the security parameter.

{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| 2nd-preimage || hash function || 256 || (3,6) || 2251.3 || ? || [http://dx.doi.org/10.1007/978-3-642-17373-8_2 Fuhr]
|-
|}

=== Building blocks ===

Here we list results on underlying building blocks, and the hash function modified by other means than the security parameter.

Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).

{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| observations || hash function || all || || || || [http://people.item.ntnu.no/~danilog/Hash/Non-random-behaviour-narrow-pipe-designs-03.pdf Gligoroski]
|-
| non-randomness || compression function || 224, 256 || 5 rounds || || || [http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt Aumasson]
|-
| near-collision || compression function || 224, 256 || 3 rounds || 221 || || [http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf Nikolic]
|-
| distinguisher || compression function || 224, 256 || 6 rounds || 227 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| distinguisher || compression function || 384, 512 || 12 rounds || 2729 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| near-collision || compression function || 224, 256 || 3 rounds || 25 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| near-collision || compression function || 224, 256 || 4 rounds || 232 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| near-collision || compression function || 224, 256 || 5 rounds || 2125 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| message-recovery || compression function || 224, 256 || 3 rounds || 210.48 || || [http://eprint.iacr.org/2010/057.pdf Calik,Turan]
|-
| pseudo-2nd-preimage || hash function || 256 || (3,6) rounds || 2254.25 || || [http://eprint.iacr.org/2010/057.pdf Calik,Turan]
|-
|}

<bibtex>
@misc{Fuhr-asiacrypt10,
author = {Thomas Fuhr},
title = {Finding Second Preimages of Short Messages for Hamsi-256},
url = {http://dx.doi.org/10.1007/978-3-642-17373-8_2},
howpublished = {In Advances in Cryptology - ASIACRYPT 2010, Proceedings},
editor = {Masayuki Abe},
year = {2010},
pages = {20-37},
publisher = {Springer},
series = {Lecture Notes in Computer Science},
volume = {6477}
}
</bibtex>

<bibtex>
@misc{hamsiGli10,
author = {Danilo Gligoroski},
title = {Narrow-pipe SHA-3 candidates differ significantly from ideal random functions defined over big domains},
url = {http://people.item.ntnu.no/~danilog/Hash/Non-random-behaviour-narrow-pipe-designs-03.pdf},
howpublished = {NIST mailing list},
year = {2010},
}
</bibtex>

<bibtex>
@misc{hamsiAum09,
author = {Jean-Philippe Aumasson},
title = {On the pseudorandomness of Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt},
howpublished = {NIST mailing list (local link)},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiN09,
author = {Ivica Nikolic},
title = {Near Collisions for the Compression Function of Hamsi-256},
url = {http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf},
howpublished = {CRYPTO rump session},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiAM9,
author = {Jean-Philippe Aumasson and Willi Meier},
title = {Zero-sum distinguishers for reduced Keccak-f and for the core functions of Luffa and Hamsi},
url = {http://www.131002.net/data/papers/AM09.pdf},
howpublished = {NIST mailing list},
year = {2009},
abstract = {We present a new type of distinguisher, called zero-sum distinguisher, and apply it to reduced versions of the Keccak-f permutation. We obtain practical and deterministic distinguishers on up to 9 rounds, and shortcut distinguishers on up to 16 rounds, out of 18 in total. These observations do not seem to affect the security of Keccak. We also briefly describe application of zero-sum distinguishers to the core permutations of Luffa and Hamsi.},
}
</bibtex>

<bibtex>
@misc{hamsiWWJW09,
author = {Meiqin Wang, Xiaoyun Wang, Keting Jia, Wei Wang},
title = {New Pseudo-Near-Collision Attack on Reduced-Round of Hamsi-256},
howpublished = {Cryptology ePrint Archive, Report 2009/484},
year = {2009},
note = {\url{http://eprint.iacr.org/}},
url = {http://eprint.iacr.org/2009/484.pdf},
abstract = {Hamsi-256 is designed by Özgül Kücük and it has been a candidate Hash function for the second round of SHA-3. The compression function of Hamsi-256 maps a 256-bit chaining value and a 32-bit message to a new 256-bit chaining value. As hashing a message, Hamsi-256 operates 3-round except for the last message it operates 6-round. In this paper, we will give the pseudo-near-collision for 5-round Hamsi-256. By the message modifying, the pseudo-near-collision for 3, 4 and 5 rounds can be found with $2^5$, $2^{32}$ and $2^{125}$ compression function computations respectively.},
}
</bibtex>

<bibtex>
@misc{hamsiWWJW09,
author = {Cagdas Calik and Meltem Sonmez Turan},
title = {Message Recovery and Pseudo-Preimage Attacks on the Compression Function of Hamsi-256},
howpublished = {Cryptology ePrint Archive, Report 2010/057}},
year = {2010},
note = {\url{http://eprint.iacr.org/}},
url = {http://eprint.iacr.org/2010/057.pdf},
abstract = {Hamsi is one of the second round candidates of the SHA-3
competition. In this study, we present non-random differential proper-
ties for the compression function of the hash function Hamsi-256. Based
on these properties, we first demonstrate a distinguishing attack that
requires a few evaluations of the compression function and extend the
distinguisher to 5 rounds with complexity 2^83 . Then, we present a mes-
sage recovery attack with complexity of 2^10.48 compression function evaluations. Also, we present a pseudo-preimage attack for the compression
function with complexity 2^254.25 . The pseudo-preimage attack on the
compression function is easily converted to a pseudo second preimage
attack on Hamsi-256 hash function with the same complexity.},
}
</bibtex>

Hamsi

2010-12-06T11:41:19Z

SThomsen: Second preimage attack on Hamsi by Fuhr

== The algorithm ==

* Author(s): Özgül Kücük
* Website: [http://homes.esat.kuleuven.be/~okucuk/hamsi/ http://homes.esat.kuleuven.be/~okucuk/hamsi/]
* NIST submission package:
**round 1/2: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Hamsi_Round2.zip Hamsi_Round2.zip] (old versions: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Hamsi.zip Hamsi.zip], [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/HamsiUpdate.zip HamsiUpdate.zip])

<bibtex>
@misc{sha3Kucuk09,
author = {Özgül Küçük},
title = {The Hash Function Hamsi},
url = {http://www.cosic.esat.kuleuven.be/publications/article-1203.pdf},
howpublished = {Submission to NIST (updated)},
year = {2009},
}
</bibtex>

<bibtex>
@misc{sha3Kucuk08,
author = {Özgül Küçük},
title = {The Hash Function Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/9/95/Hamsi.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

We distinguish between two cases: results on the complete hash function, and results on underlying building blocks.

A description of the tables is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

Recommended security parameters: '''(3,6)''' P,Pf rounds (n=224,256); '''(6,12)''' P,Pf rounds (n=384,512).

=== Hash function ===

Here we list results on the actual hash function. The only allowed modification is to change the security parameter.

{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| 2nd-preimage || hash function || 256 || (default) || 2251.3 || ? || [http://dx.doi.org/10.1007/978-3-642-17373-8_2 Fuhr]
|-
|}

=== Building blocks ===

Here we list results on underlying building blocks, and the hash function modified by other means than the security parameter.

Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).

{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| observations || hash function || all || || || || [http://people.item.ntnu.no/~danilog/Hash/Non-random-behaviour-narrow-pipe-designs-03.pdf Gligoroski]
|-
| non-randomness || compression function || 224, 256 || 5 rounds || || || [http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt Aumasson]
|-
| near-collision || compression function || 224, 256 || 3 rounds || 221 || || [http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf Nikolic]
|-
| distinguisher || compression function || 224, 256 || 6 rounds || 227 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| distinguisher || compression function || 384, 512 || 12 rounds || 2729 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| near-collision || compression function || 224, 256 || 3 rounds || 25 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| near-collision || compression function || 224, 256 || 4 rounds || 232 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| near-collision || compression function || 224, 256 || 5 rounds || 2125 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| message-recovery || compression function || 224, 256 || 3 rounds || 210.48 || || [http://eprint.iacr.org/2010/057.pdf Calik,Turan]
|-
| pseudo-2nd-preimage || hash function || 256 || (3,6) rounds || 2254.25 || || [http://eprint.iacr.org/2010/057.pdf Calik,Turan]
|-
|}

<bibtex>
@misc{Fuhr-asiacrypt10,
author = {Thomas Fuhr},
title = {Finding Second Preimages of Short Messages for Hamsi-256},
url = {http://dx.doi.org/10.1007/978-3-642-17373-8_2},
howpublished = {In Advances in Cryptology - ASIACRYPT 2010, Proceedings},
editor = {Masayuki Abe},
year = {2010},
pages = {20-37},
publisher = {Springer},
series = {Lecture Notes in Computer Science},
volume = {6477}
}
</bibtex>

<bibtex>
@misc{hamsiGli10,
author = {Danilo Gligoroski},
title = {Narrow-pipe SHA-3 candidates differ significantly from ideal random functions defined over big domains},
url = {http://people.item.ntnu.no/~danilog/Hash/Non-random-behaviour-narrow-pipe-designs-03.pdf},
howpublished = {NIST mailing list},
year = {2010},
}
</bibtex>

<bibtex>
@misc{hamsiAum09,
author = {Jean-Philippe Aumasson},
title = {On the pseudorandomness of Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt},
howpublished = {NIST mailing list (local link)},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiN09,
author = {Ivica Nikolic},
title = {Near Collisions for the Compression Function of Hamsi-256},
url = {http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf},
howpublished = {CRYPTO rump session},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiAM9,
author = {Jean-Philippe Aumasson and Willi Meier},
title = {Zero-sum distinguishers for reduced Keccak-f and for the core functions of Luffa and Hamsi},
url = {http://www.131002.net/data/papers/AM09.pdf},
howpublished = {NIST mailing list},
year = {2009},
abstract = {We present a new type of distinguisher, called zero-sum distinguisher, and apply it to reduced versions of the Keccak-f permutation. We obtain practical and deterministic distinguishers on up to 9 rounds, and shortcut distinguishers on up to 16 rounds, out of 18 in total. These observations do not seem to affect the security of Keccak. We also briefly describe application of zero-sum distinguishers to the core permutations of Luffa and Hamsi.},
}
</bibtex>

<bibtex>
@misc{hamsiWWJW09,
author = {Meiqin Wang, Xiaoyun Wang, Keting Jia, Wei Wang},
title = {New Pseudo-Near-Collision Attack on Reduced-Round of Hamsi-256},
howpublished = {Cryptology ePrint Archive, Report 2009/484},
year = {2009},
note = {\url{http://eprint.iacr.org/}},
url = {http://eprint.iacr.org/2009/484.pdf},
abstract = {Hamsi-256 is designed by Özgül Kücük and it has been a candidate Hash function for the second round of SHA-3. The compression function of Hamsi-256 maps a 256-bit chaining value and a 32-bit message to a new 256-bit chaining value. As hashing a message, Hamsi-256 operates 3-round except for the last message it operates 6-round. In this paper, we will give the pseudo-near-collision for 5-round Hamsi-256. By the message modifying, the pseudo-near-collision for 3, 4 and 5 rounds can be found with $2^5$, $2^{32}$ and $2^{125}$ compression function computations respectively.},
}
</bibtex>

<bibtex>
@misc{hamsiWWJW09,
author = {Cagdas Calik and Meltem Sonmez Turan},
title = {Message Recovery and Pseudo-Preimage Attacks on the Compression Function of Hamsi-256},
howpublished = {Cryptology ePrint Archive, Report 2010/057}},
year = {2010},
note = {\url{http://eprint.iacr.org/}},
url = {http://eprint.iacr.org/2010/057.pdf},
abstract = {Hamsi is one of the second round candidates of the SHA-3
competition. In this study, we present non-random differential proper-
ties for the compression function of the hash function Hamsi-256. Based
on these properties, we first demonstrate a distinguishing attack that
requires a few evaluations of the compression function and extend the
distinguisher to 5 rounds with complexity 2^83 . Then, we present a mes-
sage recovery attack with complexity of 2^10.48 compression function evaluations. Also, we present a pseudo-preimage attack for the compression
function with complexity 2^254.25 . The pseudo-preimage attack on the
compression function is easily converted to a pseudo second preimage
attack on Hamsi-256 hash function with the same complexity.},
}
</bibtex>

Groestl

2010-02-15T14:53:16Z

SThomsen:

== The algorithm ==

* Author(s): Praveen Gauravaram, Lars R. Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen
* Website: [http://www.groestl.info http://www.groestl.info]
* NIST submission package:
** round 1/2: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Grostl_Round2.zip Grostl_Round2.zip] (old version: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Grostl.zip Grostl.zip])

<bibtex>
@misc{sha3groestl,
author = {Praveen Gauravaram and Lars R. Knudsen and Krystian Matusiewicz and Florian Mendel and Christian Rechberger and Martin Schläffer and Søren S. Thomsen},
title = {Grøstl -- a SHA-3 candidate},
url = {http://www.groestl.info/Groestl.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

<bibtex>
@misc{sha3groestl,
author = {Praveen Gauravaram and Lars R. Knudsen and Krystian Matusiewicz and Florian Mendel and Christian Rechberger and Martin Schläffer and Søren S. Thomsen},
title = {Grøstl Addendum},
url = {http://groestl.info/Groestl-addendum.pdf},
howpublished = {Available online},
year = {2009},
}
</bibtex>

== Cryptanalysis ==

We distinguish between two cases: results on the complete hash function, and results on underlying building blocks.

A description of the tables is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

=== Hash function ===

Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.

Recommended security parameters: '''10''' rounds (n=224,256); '''14''' rounds (n=384,512)

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Size (n) || Parameters || Compression Function Calls || Memory Requirements || Reference
|-
| collision || 224,256 || 4 rounds || 264 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759 Mendel,Rechberger,Schläffer,Thomsen]
|-
| collision || 224,256 || 3 rounds || 264 || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759 Mendel,Rechberger,Schläffer,Thomsen]
|-
| collision || 384,512 || 5 rounds || 2176 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759 Mendel,Rechberger,Schläffer,Thomsen]
|-
| collision || 384,512 || 4 rounds || 264 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759 Mendel,Rechberger,Schläffer,Thomsen]
|-
|}

=== Building blocks ===

Here we list results on underlying building blocks, and the hash function modified by other means than the security parameter.

Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).

Recommended security parameters: '''10''' rounds (n=224,256); '''14''' rounds (n=384,512)

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| semi-free-start collision || compression || 256 || 7 rounds || 2120 || 264 || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
|-
| distinguisher || compression || 256 || 8 rounds || 2112 || 264 || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
|-
| distinguisher || permutation || 256 || 8 rounds || 2112 || 264 || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
|-
| semi-free-start collision || compression || 256 || 7 rounds || 2120 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759 Mendel,Rechberger,Schläffer,Thomsen]
|-
| semi-free-start collision || compression || 384,512 || 7 rounds || 2152 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759 Mendel,Rechberger,Schläffer,Thomsen]
|-
| semi-free-start collision || compression || 224,256 || 6 rounds || 264 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
|-
| distinguisher || output transformation || 224,256 || 7 rounds || 256 || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
|-
| distinguisher || permutation || 224,256 || 7 rounds || 255 || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
|-
| semi-free-start collision || compression || 256 || 6 rounds || 2120 || 264 || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943 Mendel,Rechberger,Schläffer,Thomsen]
|-
| semi-free-start collision || compression || 224,256 || 5 rounds || 264 || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943 Mendel,Rechberger,Schläffer,Thomsen]
|-
| observation || hash || all || || || || [http://ehash.iaik.tugraz.at/uploads/d/d0/Grostl-comment-april28.pdf Kelsey]
|-
| observation || block cipher || all || || || || [http://www.larc.usp.br/~pbarreto/Grizzly.pdf Barreto]
|-
| free-start collision || compression || all || any || 22n/3 || 22n/3 || [http://www.groestl.info/Groestl.pdf submission document]
|-
| pseudo-preimage || compression || all || any || 2n || - || [http://www.groestl.info/Groestl.pdf submission document]
|-
|}

<bibtex>
@inproceedings{fseGP10,
author = {Henri Gilbert and Thomas Peyrin},
title = {Super-Sbox Cryptanalysis: Improved Attacks for AES-like permutations},
url = {http://eprint.iacr.org/2009/531.pdf},
booktitle = {FSE},
year = {2010},
series = {LNCS},
note = {To appear}
abstract = {In this paper, we improve the recent rebound and start-from-the-middle attacks on AES-like permutations. Our new cryptanalysis technique uses the fact that one can view two rounds of such permutations as a layer of big Sboxes preceded and followed by simple affine transformations. The big Sboxes encountered in this alternative representation are named Super-Sboxes. We apply this method to two second-round SHA-3 candidates Grostl and ECHO, and obtain improvements over the previous cryptanalysis results for these two schemes. Moreover, we improve the best distinguisher for the AES block cipher in the known-key setting, reaching 8 rounds for the 128-bit version.}
</bibtex>

<bibtex>
@inproceedings{ctrsaMRST10,
author = {Florian Mendel and Christian Rechberger and Martin Schläffer and Søren S. Thomsen},
title = {Rebound Attacks on the Reduced Grøstl Hash Function},
url = {http://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=122759},
booktitle = {CT-RSA},
year = {2010},
publisher = {Springer},
series = {LNCS},
volume = {5985},
pages = {350-365},
note = {To appear}
abstract = {Grøstl is one of 14 second round candidates of the
NIST SHA-3 competition. Cryptanalytic results on the wide-pipe compression
function of Grøstl-256 have already been published. However, little is known
about the hash function, arguably a much more interesting cryptanalytic
setting. Also, Grøstl-512 has not been analyzed yet. In this paper, we show
the first cryptanalytic attacks on reduced-round versions of the Grøstl hash
functions. These results are obtained by several extensions of the rebound
attack. We present a collision attack on 4/10 rounds of the Grøstl-256 hash
function and 5/14 rounds of the Grøstl-512 hash functions. Additionally, we
give the best collision attack for reduced-round (7/10 and 7/14) versions of the
compression function of Grøstl-256 and Grøstl-512.}
</bibtex>

<bibtex>
@inproceedings{sacMPRS09,
author = {Florian Mendel and Thomas Peyrin and Christian
Rechberger and Martin Schläffer},
title = {Improved Cryptanalysis of the Reduced Grøstl
Compression Function, ECHO Permutation and AES Block Cipher},
url = {http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420},
booktitle = {SAC},
year = {2009},
volume = {5867},
pages = {16-35},
abstract = {In this paper, we propose two new ways to mount attacks
on the SHA-3 candidates Gr{\o}stl, and ECHO, and apply these attacks
also to the AES. Our results improve upon and extend the rebound
attack. Using the new techniques, we are able to extend the number of
rounds in which available degrees of freedom can be used. As a result,
we present the first attack on 7 rounds for the Gr{\o}stl-256 output
transformation and improve the semi-free-start collision attack on 6
rounds. Further, we present an improved known-key distinguisher for 7
rounds of the AES block cipher and the internal permutation used in
ECHO.}
</bibtex>

<bibtex>
@inproceedings{fseMRST09,
author = {Florian Mendel and Christian Rechberger and Martin Schläffer and Søren S. Thomsen},
title = {The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl},
url = {http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943},
booktitle = {FSE},
editor = {Orr Dunkelman},
year = {2009},
publisher = {Springer},
series = {LNCS},
volume = {5665},
pages = {260-276},
abstract = {In this work, we propose the rebound attack, a new tool
for the cryptanalysis of hash functions. The idea of the rebound
attack is to use the available degrees of freedom in a collision
attack to efficiently bypass the low probability parts of a
differential trail. The rebound attack consists of an inbound phase
with a match-in-the-middle part to exploit the available degrees of
freedom, and a subsequent probabilistic outbound phase. Especially on
AES based hash functions, the rebound attack leads to new attacks for
a surprisingly high number of
rounds.
We use the rebound attack to construct collisions for 4.5 rounds of
the 512-bit hash function Whirlpool with a complexity of $2^{120}$
compression function evaluations and negligible memory requirements.
The attack can be extended to a near-collision on 7.5 rounds of the
compression function of Whirlpool and 8.5 rounds of the similar hash
function Maelstrom. Additionally, we apply the rebound attack to the
SHA-3 submission Gr{\o}stl, which leads to an attack on 6 rounds of
the Gr{\o}stl-256 compression function with a complexity of $2^{120}$
and memory requirements of about $2^{64}$.}
</bibtex>

<bibtex>
@misc{groestlK09,
author = {John Kelsey},
title = {Some notes on Grøstl},
url = {http://ehash.iaik.tugraz.at/uploads/d/d0/Grostl-comment-april28.pdf},
howpublished = {Available online},
year = {2009},
abstract = {These are some quick notes on some properties and
observations of Grøstl. Nothing in this note threatens the hash
function; instead, I'm pointing out some properties that are a bit
surprising, and some broad approaches someone might take to get
attacks to work.},
}
</bibtex>

<bibtex>
@misc{groestlB08,
author = {Paulo S. L. M. Barreto},
title = {An observation on Grøstl},
url = {http://www.larc.usp.br/~pbarreto/Grizzly.pdf},
howpublished = {Available online},
year = {2008},
abstract = {An alternative view of the Groestl SHA-3 submission is
presented. It does not lead to an effective attack nor reveals a
weakness in the design, but illustrates the importance of the
double-width pipe in this construction.},
}
</bibtex>

Hamsi

2009-10-08T07:00:40Z

SThomsen:

== The algorithm ==

* Author(s): Özgül Kücük
* Website: [http://homes.esat.kuleuven.be/~okucuk/hamsi/ http://homes.esat.kuleuven.be/~okucuk/hamsi/]
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Hamsi.zip Hamsi.zip], [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/HamsiUpdate.zip HamsiUpdate.zip]
* an updated reference implementation can be found [http://homes.esat.kuleuven.be/~okucuk/hamsi/implementations.html here] (Hamsi website)

<bibtex>
@misc{sha3Kucuk08,
author = {Özgül Kücük},
title = {The Hash Function Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/9/95/Hamsi.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| | non-randomness || compression function || 224, 256 || 5 rounds || || || [http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt Aumasson]
|-
| | near-collision || compression function || 224, 256 || 3 rounds || 221 || || [http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf Nikolic]
|-
| | distinguisher || compression function || 224, 256 || 6 rounds || 227 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| | distinguisher || compression function || 384, 512 || 12 rounds || 2729 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| | near-collision || compression function || 224, 256 || 3 rounds || 25 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| | near-collision || compression function || 224, 256 || 4 rounds || 232 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| | near-collision || compression function || 224, 256 || 5 rounds || 2125 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{hamsiAum09,
author = {Jean-Philippe Aumasson},
title = {On the pseudorandomness of Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt},
howpublished = {NIST mailing list (local link)},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiN09,
author = {Ivica Nikolic},
title = {Near Collisions for the Compression Function of Hamsi-256},
url = {http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf},
howpublished = {CRYPTO rump session},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiAM9,
author = {Jean-Philippe Aumasson and Willi Meier},
title = {Zero-sum distinguishers for reduced Keccak-f and for the core functions of Luffa and Hamsi},
url = {http://www.131002.net/data/papers/AM09.pdf},
howpublished = {NIST mailing list},
year = {2009},
abstract = {We present a new type of distinguisher, called zero-sum distinguisher, and apply it to reduced versions of the Keccak-f permutation. We obtain practical and deterministic distinguishers on up to 9 rounds, and shortcut distinguishers on up to 16 rounds, out of 18 in total. These observations do not seem to affect the security of Keccak. We also briefly describe application of zero-sum distinguishers to the core permutations of Luffa and Hamsi.},
}
</bibtex>

<bibtex>
@misc{hamsiWWJW09,
author = {Meiqin Wang, Xiaoyun Wang, Keting Jia, Wei Wang},
title = {New Pseudo-Near-Collision Attack on Reduced-Round of Hamsi-256},
howpublished = {Cryptology ePrint Archive, Report 2009/484},
year = {2009},
note = {\url{http://eprint.iacr.org/}},
url = {http://eprint.iacr.org/2009/484.pdf},
abstract = {Hamsi-256 is designed by Özgül Kücük and it has been a candidate Hash function for the second round of SHA-3. The compression function of Hamsi-256 maps a 256-bit chaining value and a 32-bit message to a new 256-bit chaining value. As hashing a message, Hamsi-256 operates 3-round except for the last message it operates 6-round. In this paper, we will give the pseudo-near-collision for 5-round Hamsi-256. By the message modifying, the pseudo-near-collision for 3, 4 and 5 rounds can be found with $2^5$, $2^{32}$ and $2^{125}$ compression function computations respectively.},
}
</bibtex>

Hamsi

2009-10-08T06:58:15Z

SThomsen:

== The algorithm ==

* Author(s): Özgül Kücük
* Website: [http://homes.esat.kuleuven.be/~okucuk/hamsi/ http://homes.esat.kuleuven.be/~okucuk/hamsi/]
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Hamsi.zip Hamsi.zip], [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/HamsiUpdate.zip HamsiUpdate.zip]
* an updated reference implementation can be found [http://homes.esat.kuleuven.be/~okucuk/hamsi/implementations.html here] (Hamsi website)

<bibtex>
@misc{sha3Kucuk08,
author = {Özgül Kücük},
title = {The Hash Function Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/9/95/Hamsi.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| | non-randomness || compression function || 224, 256 || 5 rounds || || || [http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt Aumasson]
|-
| | near-collision || compression function || 224, 256 || 3 rounds || 221 || || [http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf Nikolic]
|-
| | distinguisher || compression function || 224, 256 || 6 rounds || 227 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| | distinguisher || compression function || 384, 512 || 12 rounds || 2729 || || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
|-
| | near-collision || compression function || 224, 256 || 3 rounds || 25 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| | near-collision || compression function || 224, 256 || 4 rounds || 232 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
| | near-collision || compression function || 224, 256 || 5 rounds || 2125 || || [http://eprint.iacr.org/2009/484.pdf Wang,Wang,Jia,Wang]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{hamsiAum09,
author = {Jean-Philippe Aumasson},
title = {On the pseudorandomness of Hamsi},
url = {http://ehash.iaik.tugraz.at/uploads/d/db/Hamsi_nonrandomness.txt},
howpublished = {NIST mailing list (local link)},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiN09,
author = {Ivica Nikolic},
title = {Near Collisions for the Compression Function of Hamsi-256},
url = {http://rump2009.cr.yp.to/936779b3afb9b48a404b487d6865091d.pdf},
howpublished = {CRYPTO rump session},
year = {2009},
}
</bibtex>

<bibtex>
@misc{hamsiAM9,
author = {Jean-Philippe Aumasson and Willi Meier},
title = {Zero-sum distinguishers for reduced Keccak-f and for the core functions of Luffa and Hamsi},
url = {http://www.131002.net/data/papers/AM09.pdf},
howpublished = {NIST mailing list},
year = {2009},
abstract = {We present a new type of distinguisher, called zero-sum distinguisher, and apply it to reduced versions of the Keccak-f permutation. We obtain practical and deterministic distinguishers on up to 9 rounds, and shortcut distinguishers on up to 16 rounds, out of 18 in total. These observations do not seem to affect the security of Keccak. We also briefly describe application of zero-sum distinguishers to the core permutations of Luffa and Hamsi.},
}
</bibtex>

<bibtex>
@misc{hamsiWWJW09,
author = {Meiqin Wang, Xiaoyun Wang, Keting Jia, Wei Wang},
title = {New Pseudo-Near-Collision Attack on Reduced-Round of Hamsi-256},
howpublished = {Cryptology ePrint Archive, Report 2009/484},
year = {2009},
note = {\url{http://eprint.iacr.org/}},
abstract = {Hamsi-256 is designed by \"{O}zg\"{u}l K\"{u}c\"{u}k and it has been a candidate Hash function for the second round of SHA-3. The compression function of Hamsi-256 maps a 256-bit chaining value and a 32-bit message to a new 256-bit chaining value. As hashing a message, Hamsi-256 operates 3-round except for the last message it operates 6-round. In this paper, we will give the pseudo-near-collision for 5-round Hamsi-256. By the message modifying, the pseudo-near-collision for 3, 4 and 5 rounds can be found with $2^5$, $2^{32}$ and $2^{125}$ compression function computations respectively.},
}
</bibtex>

Shabal

2009-06-30T08:24:05Z

SThomsen: French accents

== The algorithm ==

* Author(s): Emmanuel Bresson, Anne Canteaut, Benoît Chevallier-Mames, Christophe Clavier, Thomas Fuhr, Aline Gouget, Thomas Icart, Jean-François Misarsky, Marìa Naya-Plasencia, Pascal Paillier, Thomas Pornin, Jean-René Reinhard, Céline Thuillet, Marion Videau
* Website: http://www.shabal.com/
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Shabal.zip Shabal.zip]

<bibtex>
@misc{sha3CanteautCGPP08,
author = {Emmanuel Bresson and Anne Canteaut and Benoît Chevallier-Mames and Christophe Clavier and Thomas Fuhr and Aline Gouget and Thomas Icart and Jean-François Misarsky and Marìa Naya-Plasencia and Pascal Paillier and Thomas Pornin and Jean-René Reinhard and Céline Thuillet and Marion Videau},
title = {Shabal, a Submission to NIST’s Cryptographic Hash Algorithm Competition},
url = {http://ehash.iaik.tugraz.at/uploads/6/6c/Shabal.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

<bibtex>
@misc{cryptoeprint:2009:199,
author = {Emmanuel Bresson and Anne Canteaut and Benoît Chevallier-Mames and Christophe Clavier and Thomas Fuhr and Aline Gouget and Thomas Icart and Jean-François Misarsky and Marìa Naya-Plasencia and Pascal Paillier and Thomas Pornin and Jean-René Reinhard and Céline Thuillet and Marion Videau},
title = {Indifferentiability with Distinguishers: Why Shabal Does Not Require Ideal Ciphers},
howpublished = {Cryptology ePrint Archive, Report 2009/199},
year = {2009},
url = {http://eprint.iacr.org/2009/199.pdf},
abstract = {Shabal is based on a new provably secure mode of operation. Some related-key distinguishers for the underlying keyed permutation have been exhibited recently by Aumasson et al. and Knudsen et al., but with no visible impact on the security of Shabal. This paper then aims at extensively studying such distinguishers for the keyed permutation used in Shabal, and at clarifying the impact that they exert on the security of the full hash function. Most interestingly, a new security proof for Shabal's mode of operation is provided where the keyed permutation is not assumed to be an ideal cipher anymore, but observes a distinguishing property i.e., an explicit relation verified by all its inputs and outputs. As a consequence of this extended proof, all known distinguishers for the keyed permutation are proven not to weaken the security of Shabal. In our study, we provide the foundation of a generalization of the indifferentiability framework to biased random primitives, this part being of independent interest.},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| | non-randomness || permutation || all || (p,r)=(3,12) || 212 || || [http://131002.net/data/papers/Aum09.pdf Aumasson]
|-
| | non-randomness || permutation || all || any (p,r) || 1 || || [http://www.mat.dtu.dk/people/S.Thomsen/shabal/shabal.pdf Knudsen,Matusiewicz,Thomsen]
|-
| | non-randomness || permutation || all || any (p,r) || 2 || || [http://131002.net/data/papers/AMM09.pdf Aumasson,Mashatan,Meier]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{shabalAum09,
author = {Jean-Philippe Aumasson},
title = {On the pseudorandomness of Shabal's keyed permutation},
url = {http://131002.net/data/papers/Aum09.pdf},
howpublished = {Available online},
year = {2009},
abstract = {
We report observations suggesting that the permutation used in
Shabal does not behave pseudorandomly. This does not affect the
security of Shabal as submitted to the NIST Hash Competition.},
}
</bibtex>

<bibtex>
@misc{shabalKMT09,
author = {Lars R. Knudsen and Krystian Matusiewicz and Søren S. Thomsen},
title = {Observations on the Shabal keyed permutation},
url = {http://www.mat.dtu.dk/people/S.Thomsen/shabal/shabal.pdf },
howpublished = {OFFICIAL COMMENT},
year = {2009},
abstract = {
In this note we show that the permutation P used in the Shabal hash function, which is
a candidate in the SHA-3 competition, has some non-random properties. As an example,
it is easy to find a number of fixed points in the permutation. Moreover, large key-multicollisions
can be easily found; these are multi-collisions where only the key input contains
a difference. All observations are easily verified, and most of them are independent of the
choice of security parameters. Our observations, on the other hand, do not seem extensible
to the full hash function.
}
</bibtex>

<bibtex>
@misc{shabalAum09a,
author = {Jean-Philippe Aumasson and Atefeh Mashatan and Willi Meier},
title = {More on Shabal's permutation},
url = {http://131002.net/data/papers/AMM09.pdf},
howpublished = {OFFICIAL COMMENT},
year = {2009},
}
</bibtex>

Cryptanalysis Categories

2009-06-24T09:45:06Z

SThomsen: /* Main Cryptanalysis Table */

For presentation reasons, we provide a ''simplified'' overview of cryptanalytic results in The SHA-3 Zoo. We only consider cryptanalytic results that have not been performed by the designers themselves and are included in the initial proposal. Exceptions are cryptanalytic results by non-designers and cryptanalytic results by designers that are not mentioned in the proposal.

== Color Codes ==

Different color codes should give a better overview of the impact of cryptanalytic results. The color codes are only used for results on the main NIST requirements of the full hash function with recommended parameters.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="100"| color !! Complexity of Result !! Explanation
|-
| style="background:greenyellow" | || compr. calls < generic || align="left" | The number of compression function calls (or equivalents) is below generic attacks for collision, 2nd preimage or preimage. The complexity of the attack is very close to generic attacks and is therefore of lesser relevance. Additionally, attacks in this simple model may neglect memory considerations. However, attacks of this type do not exist for the SHA-2 hash functions.
|-
| style="background:yellow" | || compr. calls < generic * 1/n || align="left" | The number of compression function calls (or equivalents) is below generic attacks reduced by a factor of n (hash size) for collision, 2nd preimage or preimage. Attacks in this simple model may neglect memory considerations. However, attacks of this type do not exist for the SHA-2 hash functions.
|-
| style="background:orange" | || time * memory < generic * 1/n || align="left" | The time*memory product is below generic attacks reduced by a factor of n (hash size) for collision, 2nd preimage or preimage.
|-
| style="background:red" | || practical example || align="left" | A practical example is given for the attack on this hash function. This is an extra category since practical examples improve the confidence in an attack.
|-
|}

== Main Cryptanalysis Table ==

The main table should give a first impression on the remaining SHA-3 candidates. It shows only the best known attack, more detailed results are given in the individual hash function tables.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="140"| column !! Explanation
|-
| style="background:#efefef;"| Hash Name || align="left" | More detailed information about this SHA-3 candidate is given at its WikiPage.
|-
| style="background:#efefef;"| Principal Submitter || align="left" | This column shows only the principal submitter. Additional contributors are listed at the individual hash function pages and all submitters are listed [http://ehash.iaik.tugraz.at/wiki/SHA-3_submitters here].
|-
| style="background:#efefef;"| Best Attack on Main NIST Requirements || align="left" | In this column the best collision, 2nd-preimage or preimage attack is shown. To give a quick overview of the complexity of the best attack, the cells are labeled with different colors.
|-
| style="background:#efefef;"| Best Attack on other Hash Requirements || align="left" | Best attack on additional requirements for a hash function not unambiguously specified by NIST yet.
|-
|}

== Individual Hash Function Tables ==

The individual hash function tables give a more detailed overview of the cryptanalytic results with its complexity. The order of entries does not imply a ranking of the attacks. A dash (-) in the individual table means that the complexities are neglible. A question mark (?) means that the information is not given or unclear. We ask the authors to include these results in the abstract of their publication.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="140"| column !! Explanation
|-
| style="background:#efefef;"| Type of Analysis || align="left" | This column gives a first impression what (requirement) has been analyzed. Some results do not violate any security requirements. Only attacks on the main NIST requirements and for the full hash function with recommended parameters are highlighted.
|-
| style="background:#efefef;"| Hash Function Part || align="left" | Shows which part of the hash function has been attacked.
|-
| style="background:#efefef;"| Hash Size (n) || align="left" | The hash sizes for which the attack applies with the given complexity.
|-
| style="background:#efefef;"| Parameters/Variants || align="left" | Gives the parameters for attacks on reduced variants. The column is left empty if the attack is on the recommended parameters of the designers.
|-
| style="background:#efefef;"| Compression Function Calls || align="left" | The number of compression function calls (or equivalents) as given by the authors.
|-
| style="background:#efefef;"| Memory Requirements || align="left" | The memory requirements of the attack as given by the authors.
|-
| style="background:#efefef;"| Reference || align="left" | A link the published result.
|-
|}

SHAvite-3

2009-06-24T09:37:52Z

SThomsen: Added Nandi and Paul's new fixed points in the SHAvite-3-256 block cipher

== The algorithm ==

* Author(s): Eli Biham and Orr Dunkelman

* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/SHAvite-3.zip SHAvite-3.zip]

<bibtex>
@misc{sha3BihamD08,
author = {Eli Biham and Orr Dunkelman},
title = {The SHAvite-3 Hash Function},
url = {http://ehash.iaik.tugraz.at/uploads/f/f5/Shavite.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| | pseudo-collision || compression || all || || || || [http://ehash.iaik.tugraz.at/uploads/e/ea/Peyrin-SHAvite-3.txt Peyrin]
|-
| | pseudo-collision || compression || 256 || || || || [http://ehash.iaik.tugraz.at/uploads/5/5c/NandiP-SHAvite-3.txt Nandi,Paul]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{Peyrin-SHAvite-3,
author = {Thomas Peyrin},
title = {Chosen-salt, chosen-counter, pseudo-collision on SHAvite-3 compression function},
url = {http://ehash.iaik.tugraz.at/uploads/e/ea/Peyrin-SHAvite-3.txt},
howpublished = {Available online},
year = {2009},
}
</bibtex>

<bibtex>
@misc{NandiP-SHAvite-3,
author = {Mridul Nandi and Souradyuti Paul},
title = {OFFICIAL COMMENT: SHAvite-3},
url = {http://ehash.iaik.tugraz.at/uploads/5/5c/NandiP-SHAvite-3.txt},
howpublished = {Available online},
year = {2009},
}
</bibtex>

File:NandiP-SHAvite-3.txt

2009-06-24T09:29:42Z

SThomsen:

ESSENCE

2009-06-16T14:10:15Z

SThomsen:

== The algorithm ==

* Authors: Jason Worth Martin
* Website: [http://www.math.jmu.edu/~martin/essence/ http://www.math.jmu.edu/~martin/essence/]
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/ESSENCE.zip ESSENCE.zip]

<bibtex>
@misc{sha3Martin08,
author = {Jason Worth Martin},
title = {ESSENCE: A Candidate Hashing Algorithm for the NIST Competition},
url = {http://www.math.jmu.edu/~martin/essence/Supporting_Documentation/essence_NIST.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

<bibtex>
@misc{sha3Martin08a,
author = {Jason Worth Martin},
title = {ESSENCE: A Family of Cryptographic Hashing Algorithms},
url = {http://www.math.jmu.edu/~martin/essence/Supporting_Documentation/essence_compression.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

<bibtex>
@misc{sha3Martin08b,
author = {Jason Worth Martin},
title = {ESSENCE: Errata},
url = {http://www.math.jmu.edu/~martin/essence/Supporting_Documentation/essence_errata.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| observation || compression function || all || || - || - || [http://www.mat.dtu.dk/people/S.Thomsen/essence/Essence-obs.pdf Mouha,Thomsen,Turan]
|-
| observation || compression function || all || || - || - || [http://www.nickymouha.be/papers/Essence-MouhaSekar.pdf Mouha et al.]
|-
| key recovery || block cipher || 256 || 14 rounds || 2225 || - || [http://www.nickymouha.be/papers/Essence-MouhaSekar.pdf Mouha et al.]
|-
| key recovery || block cipher || 512 || 14 rounds || 2450 || - || [http://www.nickymouha.be/papers/Essence-MouhaSekar.pdf Mouha et al.]
|-
| pseudo-collision || hash || 512 || 31 rounds || 2252.8 || - || [http://www.nickymouha.be/papers/Essence-MouhaSekar.pdf Mouha et al.]
|-
| style="background:orange" | collision || hash || 224/256 || || 2109 || - || [http://www.131002.net/data/papers/NRALMP09.pdf Naya-Plasencia et al.]
|-
| style="background:orange" | collision || hash || 512 || || 2198 || - || [http://www.131002.net/data/papers/NRALMP09.pdf Naya-Plasencia et al.]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{essenceMTT09,
author = {Nicky Mouha and Søren S. Thomsen and Meltem Sönmez Turan},
title = {Observations of non-randomness in the ESSENCE compression function},
url = {http://www.mat.dtu.dk/people/S.Thomsen/essence/Essence-obs.pdf},
howpublished = {Available online},
year = {2009}
}
</bibtex>

<bibtex>
@misc{essenceMSAPTMP09,
author = {Nicky Mouha and Gautham Sekar and Jean-Philippe Aumasson and Thomas Peyrin and Søren S. Thomsen and Meltem Sönmez Turan and Bart Preneel},
title = {Cryptanalysis of the ESSENCE Family of Hash Functions},
url = {http://www.nickymouha.be/papers/Essence-MouhaSekar.pdf},
howpublished = {Available online},
year = {2009}
}
</bibtex>

<bibtex>
@misc{essenceNRALMP09,
author = {María Naya-Plasencia and Andrea Röck and Jean-Philippe Aumasson and Gaëtan Leurent and Willi Meier and Thomas Peyrin},
title = {Cryptanalysis of ESSENCE},
url = {http://www.131002.net/data/papers/NRALMP09.pdf},
howpublished = {Available online},
year = {2009}
}
</bibtex>

MCSSHA-3

2009-06-04T12:43:00Z

SThomsen: 2n -> 2nd

== The algorithm ==

* Author(s): Mikhail Maslennikov
* Website: [http://registercsp.nets.co.kr/hash_competition.htm http://registercsp.nets.co.kr/hash_competition.htm]
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/MCSSHA3.zip MCSSHA3.zip]

<bibtex>
@misc{sha3M08,
author = {Mikhail Maslennikov},
title = {SECURE HASH ALGORITHM MCSSHA-3},
url = {http://registercsp.nets.co.kr/MCSSHA/MCSSHA-3.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| style="background:orange" | 2nd preimage || hash || all || || 23n/8 || ? || [http://131002.net/data/papers/AN09.pdf Aumasson,Naya-Plasencia]
|-
| style="background:orange" | 2nd preimage || hash || 256,512 || MCSSHA-4 || 22n/3 || ? || [http://131002.net/data/papers/AN09.pdf Aumasson,Naya-Plasencia]
|-
| style="background:orange" | 2nd preimage || hash || 256,512 || MCSSHA-5 || 22n/3 || ? || [http://131002.net/data/papers/AN09.pdf Aumasson,Naya-Plasencia]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{mcsAN09,
author = {Jean-Philippe Aumasson and María Naya-Plasencia},
title = {Cryptanalysis of the MCSSHA Hash Functions},
url = {http://131002.net/data/papers/AN09.pdf},
howpublished = {OFFICIAL COMMENT},
year = {2009},
}
</bibtex>

=== Archive ===

<bibtex>
@misc{mcsAN08,
author = {Jean-Philippe Aumasson and María Naya-Plasencia},
title = {Second preimages on MCSSHA-3},
url = {http://131002.net/data/papers/AN08.pdf},
howpublished = {Available online},
year = {2008},
abstract = {MCSSHA-3 is a hash function submitted to the NIST Hash Competition. This paper shows how to find second preimages for MCSSHA-3 with h-bit digest in $2^{3h/4}$, and collisions in $2^{3h/8}$. These observations make MCSSHA-3 ineligible for SHA-3.},
}
</bibtex>

User:SThomsen

2009-04-20T12:30:17Z

SThomsen:

[http://www.mat.dtu.dk/people/S.Thomsen SThomsen]

The SHA-3 Zoo

2009-04-08T10:49:11Z

SThomsen: Accented characters

The SHA-3 Zoo (work in progress) is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (see also [http://en.wikipedia.org/wiki/SHA-3 here]). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates. Another categorization of the SHA-3 submissions can be found [http://eprint.iacr.org/2008/511.pdf here].
 
The idea of the SHA-3 Zoo is to give a good overview of cryptanalytic results. We try to avoid additional judgement whether a submission is broken. The answer to this question is left to NIST. However, we categorize the cryptanalytic results by their impact from very theoretic to practical attacks. A detailed description is given in [[Cryptanalysis Categories]].

At this time, 56 out of 64 submissions to the SHA-3 competition are publicly known and available. 51 [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html submissions] have advanced to the first round.
So far, 10 out of 51 first round candidates have been officially conceded broken or withdrawn by the designers.

The following table should give a first impression on the remaining SHA-3 candidates. It shows only the best known attack, more detailed results are collected at the individual hash function pages. A description of the main table is given [[Cryptanalysis_Categories#Main_Cryptanalysis_Table | here]].

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120"| Best Attack on Main NIST Requirements !! width="140"| Best Attack on other Hash Requirements
|-
| [[ARIRANG]] || Jongin Lim || ||
|-
| [[AURORA]] || Masahiro Fujita || style="background:orange"| 2nd preimage ||
|-
| [[BLAKE]] || Jean-Philippe Aumasson || ||
|-
| [[Blender]] || Colin Bradbury || style="background:orange" | preimage || near-collision
|-
| [[Blue Midnight Wish]] || Svein Johan Knapskog || ||
|-
| [[Cheetah]] || Dmitry Khovratovich || || length-extension
|-
| [[CHI]] || Phillip Hawkes || ||
|-
| [[CRUNCH]] || Jacques Patarin || || length-extension
|-
| [[CubeHash]] || Daniel J. Bernstein || style="background:greenyellow" | preimage ||
|-
| [[Dynamic SHA]] || Xu Zijie || style="background:orange"|collision || length-extension
|-
| [[Dynamic SHA2]] || Xu Zijie || || length-extension
|-
| [[ECHO]] || Henri Gilbert || ||
|-
| [[ECOH]] || Daniel R. L. Brown || ||
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || Danilo Gligoroski || style="background:yellow" | preimage ||
|-
| [[EnRUPT]] || Sean O'Neil || style="background:red" | collision ||
|-
| [[ESSENCE]] || Jason Worth Martin || ||
|-
| [[FSB (SHA-3 submission) | FSB]] || Matthieu Finiasz || ||
|-
| [[Fugue]] || Charanjit S. Jutla || ||
|-
| [[Groestl|Grøstl]] || Lars R. Knudsen || ||
|-
| [[Hamsi]] || <nowiki>Özgül Küçük</nowiki> || ||
|-
| [[JH]] || Hongjun Wu || style="background:greenyellow" | preimage ||
|-
| [[Keccak]] || The Keccak Team || ||
|-
| [[LANE]] || Sebastiaan Indesteege || ||
|-
| [[Lesamnta]] || Hirotaka Yoshida || ||
|-
| [[Luffa]] || Dai Watanabe || ||
|-
| [[LUX]] || <nowiki>Ivica Nikolić</nowiki> || ||
|-
| [[MCSSHA-3]] || Mikhail Maslennikov || style="background:orange" | collision ||
|-
| [[MD6]] || Ronald L. Rivest || ||
|-
| [[NaSHA]] || Smile Markovski || style="background:orange" | collision ||
|-
| [[SANDstorm]] || Rich Schroeppel || ||
|-
| [[Sarmal]] || <nowiki>Kerem Varıcı</nowiki> || style="background:yellow" | preimage ||
|-
| [[Sgàil]] || Peter Maxwell|| style="background:red" | collision ||
|-
| [[Shabal]] || <nowiki>Jean-François Misarsky</nowiki> || ||
|-
| [[SHAvite-3]] || Orr Dunkelman || ||
|-
| [[SIMD]] || <nowiki>Gaëtan Leurent</nowiki> || ||
|-
| [[Skein]] || Bruce Schneier || ||
|-
| [[Spectral Hash]] || <nowiki>Çetin Kaya Koç</nowiki> || style="background:red" | collision ||
|-
| [[SWIFFTX]] || Daniele Micciancio || ||
|-
| [[TIB3]] || Daniel Penazzi || style="background:yellow" | collision ||
|-
| [[Twister]] || Michael Gorski || style="background:orange" | preimage ||
|-
| [[Vortex (SHA-3 submission)|Vortex]] || Michael Kounavis || style="background:yellow" | preimage ||
|}

The following hash functions have been submitted to the NIST competition but did not advance to the first round, or have been conceded broken or withdrawn by the designers:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120" | Status !! width="120" | Best Attack on Main NIST Requirements
|-
| [[Abacus]] || Neil Sholer || conceded broken || style="background:orange" | 2nd-preimage
|-
| [[Boole]] || Greg Rose || conceded broken || style="background:red" | collision
|-
| [[DCH]] || David A. Wilson || conceded broken || style="background:red" | collision
|-
| [[HASH 2X]] || Jason Lee || not in round 1 || style="background:red" | 2nd-preimage
|-
| [[Khichidi-1]] || M. Vidyasagar || conceded broken || style="background:red" | collision
|-
| [[Maraca]] || Robert J. Jenkins || not in round 1 || style="background:red" | preimage
|-
| [[MeshHash]] || Björn Fay || conceded broken || style="background:orange" | 2nd preimage
|-
| [[NKS2D]] || Geoffrey Park || not in round 1 || style="background:red" | collision
|-
| [[Ponic]] || Peter Schmidt-Nielsen || not in round 1 || style="background:yellow" | 2nd-preimage
|-
| [[SHAMATA]] || Orhun Kara || conceded broken || style="background:red" | collision
|-
| [[StreamHash]] || Michal Trojnara || conceded broken || style="background:red" | collision
|-
| [[Tangle]] || Rafael Alvarez || conceded broken || style="background:red" | collision
|-
| [[WaMM]] || John Washburn || conceded broken || style="background:red" | collision
|-
| [[Waterfall]] || Bob Hattersley || conceded broken || style="background:orange" | collision
|-
| [[ZK-Crypt]] || Carmi Gressel || not in round 1 ||
|-
|}

Your analysis is not mentioned? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

SHA-3 submitters

2009-04-08T10:44:14Z

SThomsen: Accented characters

Below, all (191) known SHA-3 candidate submitters are listed with affiliation and candidate algorithm. In many cases, the affiliations were found using [http://www.google.com Google], and hence may be outdated or otherwise erroneous. If you find errors, drop a line at sha3zoo@iaik.tugraz.at to let us know.

[[The_SHA-3_Zoo|Click here]] to go back to the SHA-3 Zoo main page.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="180"| Submitter name !! width="400"| Affiliation !! width="180"| Algorithm(s)
|-
| <nowiki>Benjamin Agre</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Toru Akishita</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Rafael Alvarez</nowiki> || University of Alicante, Spain || [[Tangle]]
|-
| <nowiki>Jørn Amundsen</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Elena Andreeva</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Adrian Antipa</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Yuriy Arbitman</nowiki> || ? || [[SWIFFTX]]
|-
| <nowiki>Adem Atalay</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Daniel Augot</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Jean-Philippe Aumasson</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Daniel V. Bailey</nowiki> || RSA Laboratories || [[MD6]]
|-
| <nowiki>Mihir Bellare</nowiki> || University of California San Diego, USA || [[Skein]]
|-
| <nowiki>Ryad Benadjila</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Dan Bernstein</nowiki> || University of Illinois at Chicago, USA || [[CubeHash]]
|-
| <nowiki>Guido Bertoni</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Eli Biham</nowiki> || Technion, Israel || [[SHAvite-3]]
|-
| <nowiki>Olivier Billet</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Alex Biryukov</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Charles Bouillaguet</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Colin Bradbury</nowiki> || ? || [[Blender]]
|-
| <nowiki>Emmanuel Bresson</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Daniel R. L. Brown</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Jon Callas</nowiki> || PGP Corporation || [[Skein]]
|-
| <nowiki>Matt Campagna</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Anne Canteaut</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Donghoon Chang</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Benoît Chevallier-Mames</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Christophe Clavier</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Michael Collins</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Christopher Crutchfield</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Joan Daemen</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Nathan Dautenhahn</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Christophe De Cannière</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]], [[Luffa]]
|-
| <nowiki>Cevahir Demirkıran</nowiki> || Universitat Autònoma de Barcelona, Spain || [[Spectral Hash]]
|-
| <nowiki>Yevgeniy Dodis</nowiki> || New York University, USA || [[MD6]]
|-
| <nowiki>Gil Dogon</nowiki> || Mobileye Inc., Israel || [[SWIFFTX]]
|-
| <nowiki>Tim Draelos</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Aleš Drápal</nowiki> || Charles University, Czech Republic || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Orr Dunkelman</nowiki> || École Normale Supérieure (Ulm), France || [[LANE]], [[SHAvite-3]]
|-
| <nowiki>Mohamed El-Hadedy</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Björn Fay</nowiki> || Justus Liebig-Universität, Germany || [[MeshHash]]
|-
| <nowiki>Niels Ferguson</nowiki> || Microsoft Corporation || [[Skein]]
|-
| <nowiki>Matthieu Finiasz</nowiki> || École Nationale Supérieure de Techniques Avancées, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Ewan Fleischmann</nowiki> || Bauhaus-University Weimar, Germany || [[Twister]]
|-
| <nowiki>Kermin Elliott Fleming</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Christian Forler</nowiki> || Sirrix AG || [[Twister]]
|-
| <nowiki>Pierre-Alain Fouque</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Thomas Fuhr</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Philippe Gaborit</nowiki> || Université de Limoges, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Praveen Gauravaram</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Henri Gilbert</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Danilo Gligoroski</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Michael Gorski</nowiki> || Bauhaus-University Weimar, Germany || [[Twister]]
|-
| <nowiki>Louis Goubin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Aline Gouget</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Shay Gueron</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Shai Halevi</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>William E. Hall</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Bob Hattersley</nowiki> || Opta Consulting || [[Waterfall]]
|-
| <nowiki>Phil Hawkes</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Luca Henzen</nowiki> || Eidgenössische Technische Hochschule Zürich, Switzerland || [[BLAKE]], [[EnRUPT]]
|-
| <nowiki>Shoichi Hirose</nowiki> || University of Fukui, Japan || [[Lesamnta]]
|-
| <nowiki>Seokhie Hong</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Thomas Icart</nowiki> || Sagem Sécurité || [[Shabal]]
|-
| <nowiki>Sebastiaan Indesteege</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Mickael Ivascot</nowiki> || ? || [[CRUNCH]]
|-
| <nowiki>Tetsu Iwata</nowiki> || Nagoya University, Japan || [[AURORA]]
|-
| <nowiki>William Jalby</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Robert J. Jenkins Jr.</nowiki> || Private individual || [[Maraca]]
|-
| <nowiki>Charanjit S. Jutla</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Changheon Kang</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Jinkeon Kang</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Orhun Kara</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Ferhat Karakoc</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Emilia Käsper</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Asif Khan</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Dmitry Khovratovich</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Jongsung Kim</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Vlastimil Klima</nowiki> || Independent cryptologist - consultant, Czech Republic || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Svein Johan Knapskog</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Lars R. Knudsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Çetin Kaya Koç</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Çelebi Kocair</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Ljupco Kocarev</nowiki> || University of California San Diego, USA and Macedonian Academy of Sciences and Arts || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Tadayoshi Kohno</nowiki> || University of Washington, USA || [[Skein]]
|-
| <nowiki>Michael Kounavis</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Jayant Krishnamurthy</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Hidenori Kuwakado</nowiki> || Kobe University, Japan || [[Lesamnta]]
|-
| <nowiki>Özgül Küçük</nowiki> || Katholieke Universiteit Leuven, Belgium || [[Hamsi]]
|-
| <nowiki>Changhoon Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jason Lee</nowiki> || ? || [[HASH 2X]]
|-
| <nowiki>Jesang Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jongtae Lee</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Sangjin Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Yuseop Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jongin Lim</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Gaëtan Leurent</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Yuncheng Lin</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Stefan Lucks</nowiki> || Bauhaus-Universität Weimar, Germany || [[Skein]]
|-
| <nowiki>Olivier Ly</nowiki> || Université Bordeaux, France || [[CRUNCH]]
|-
| <nowiki>Vadim Lyubashevsky</nowiki> || Tel-Aviv University, Israel || [[SWIFFTX]]
|-
| <nowiki>Gilles Macario-Rat</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Megan Maguire</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Sean Malone</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Cevat Manap</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Stéphane Manuel</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Smile Markovski</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[NaSHA]]
|-
| <nowiki>Jason Worth Martin</nowiki> || James Madison University, USA || [[ESSENCE]]
|-
| <nowiki>Mikhail Maslennikov</nowiki> || NETS Corporation || [[MCSSHA-3]]
|-
| <nowiki>Krystian Matusiewicz</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Maxwell</nowiki> || Private individual || [[Sgàil]]
|-
| <nowiki>Cameron McDonald</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Gary McGuire</nowiki> || University College Dublin, Ireland || [[Tangle]]
|-
| <nowiki>Willi Meier</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Florian Mendel</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Daniele Micciancio</nowiki> || University of California at San Diego, USA || [[SWIFFTX]]
|-
| <nowiki>Marija Mihova</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Aleksandra Mileva</nowiki> || University Goce Delčev, Macedonia || [[NaSHA]]
|-
| <nowiki>Carl Minden</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jean-François Misarsky</nowiki> || France Telecom || [[Shabal]]
|-
| <nowiki>Stig Frode Mjølsnes</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Miguel Montes</nowiki> || Universidad Nacional de Córdoba, Argentina || [[TIB3]]
|-
| <nowiki>Shiho Moriai</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Valerie Nachef</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Marìa Naya-Plasencia</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Ivica Nikolić</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Svetla Nikova</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Karsten Nohl</nowiki> || University of Virginia, USA || [[EnRUPT]]
|-
| <nowiki>Rune Steinsmo Ødegård</nowiki> || Norwegian University of Science and Technology, Norway || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Sean O'Neil</nowiki> || VEST Corporation || [[EnRUPT]]
|-
| <nowiki>Hilarie Orman</nowiki> || Purple Streak, USA|| [[SANDstorm]]
|-
| <nowiki>Onur Özen</nowiki> || Ecole Polytechnique Fédérale de Lausanne, Switzerland || [[Sarmal]]
|-
| <nowiki>Pascal Paillier</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Geoffrey Park</nowiki> || ? || [[NKS2D]]
|-
| <nowiki>Jacques Patarin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Michaël Peeters</nowiki> || NXP Semiconductors || [[Keccak]]
|-
| <nowiki>Chris Peikert</nowiki> || SRI International || [[SWIFFTX]]
|-
| <nowiki>Daniel Penazzi</nowiki> || Universidad Nacional de Córdoba, Argentina || [[TIB3]]
|-
| <nowiki>Thomas Peyrin</nowiki> || Orange Labs/Ingenico || [[ECHO]]
|-
| <nowiki>Raphael C.-W. Phan</nowiki> || Loughborough University, UK || [[BLAKE]]
|-
| <nowiki>Thomas Pornin</nowiki> || Cryptolog International || [[Shabal]]
|-
| <nowiki>Bart Preneel</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Christian Rechberger</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Jean-René Reinhard</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Leo Reyzin</nowiki> || Boston University, USA || [[MD6]]
|-
| <nowiki>Ron Rivest</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Matt Robshaw</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Greg Rose</nowiki> || QUALCOMM Inc. || [[Boole]]
|-
| <nowiki>Alon Rosen</nowiki> || IDC Herzliya, Israel || [[SWIFFTX]]
|-
| <nowiki>Gokay Saldamlı</nowiki> || Oregon State University, USA || [[Spectral Hash]]
|-
| <nowiki>Hisayoshi Sato</nowiki> || Hitachi || [[Luffa]]
|-
| <nowiki>Martin Schläffer</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Schmidt-Nielsen</nowiki> || ? || [[Ponic]]
|-
| <nowiki>Bruce Schneier</nowiki> || BT Group plc || [[Skein]]
|-
| <nowiki>Richard Schroeppel</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Nicolas Sendrier</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Yannick Seurin</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Emily Shen</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Kyoji Shibutani</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Taizo Shirai</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Neil Sholer</nowiki> || WaveStrong, Inc. || [[Abacus]]
|-
| <nowiki>René Struik</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Jim Sukha</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Jaechul Sung</nowiki> || University of Seoul, Korea || [[ARIRANG]]
|-
| <nowiki>Drew Sutherland</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Søren S. Thomsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Céline Thuillet</nowiki> || EADS Secure Networks || [[Shabal]]
|-
| <nowiki>Elmar Tischhauer</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Jacob Topper</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Mark Torgerson</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Joana Treger</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Alex Troesch</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Michal Trojnara</nowiki> || ? || [[StreamHash]]
|-
| <nowiki>Eran Tromer</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Gilles Van Assche</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Kerem Varıcı</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Marion Videau</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Natarajan Vijayarangan</nowiki> || Tata Consultancy Services || [[Khichidi-1]]
|-
| <nowiki>Emmanuel Volte</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Andrea Walker</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Cody Walker</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jesse Walker</nowiki> || Intel Corporation || [[Skein]]
|-
| <nowiki>John Washburn</nowiki> || Washburn Research || [[WaMM]]
|-
| <nowiki>Dai Watanabe</nowiki> || Hitachi || [[Luffa]]
|-
| <nowiki>Doug Whiting</nowiki> || Hifn, Inc. || [[Skein]]
|-
| <nowiki>David A. Wilson</nowiki> || Massachusetts Institute of Technology, USA || [[DCH]]
|-
| <nowiki>Hongjun Wu</nowiki> || Institute for Infocomm Research, Singapore || [[JH]]
|-
| <nowiki>Zijie Xu</nowiki> || ? || [[Dynamic SHA]], [[Dynamic SHA2]]
|-
| <nowiki>Yiqun Lisa Yin</nowiki> || Independent cryptography and security consultant || [[MD6]]
|-
| <nowiki>Hirotaka Yoshida</nowiki> || Hitachi || [[Lesamnta]]
|-
| <nowiki>Antonio Zamora</nowiki> || University of Alicante, Spain || [[Tangle]]
|}

NaSHA

2009-02-18T08:18:52Z

SThomsen:

== The algorithm ==

* Author(s): Smile Markovski, Aleksandra Mileva
* Website: [http://inf.ugd.edu.mk/images/stories/file/Mileva/Nasha.htm http://inf.ugd.edu.mk/images/stories/file/Mileva/Nasha.htm]
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/NaSHA.zip NaSHA.zip]

<bibtex>
@misc{sha3MM08,
author = {Smile Markovski and Aleksandra Mileva },
title = {2.B.1 Algorithm Specification},
url = {http://inf.ugd.edu.mk/images/stories/file/Mileva/part2b1.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| | free-start collision || compression || all || || 232 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| | free-start preimage || compression || 224,256 || || ~2128 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| | free-start preimage || compression || 384,512 || || ~2256 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| | free-start collision || compression || all || || - || - || [http://eprint.iacr.org/2008/519.pdf Ji,Liangyu,Xu]
|-
| style="background:yellow" | collision || hash || 512 || || 2192 || ? || [http://eprint.iacr.org/2008/519.pdf Ji,Liangyu,Xu]
|-
| style="background:orange" | collision || hash || 384,512 || || 2128 || - || [http://eprint.iacr.org/2009/026.pdf Z. Li, D. Li]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{nashaNK08,
author = {Ivica Nikolić and Dmitry Khovratovich},
title = {Free-start attacks on NaSHA},
url = {http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf},
howpublished = {Available online},
year = {2008},
abstract = {We present a free-start collision and a free-start preimage
attack on NaSHA. The attacks exploit the fact that when the state, obtained
after the linear transformation, is only partially fixed then the
quasigroup operations are fully determined. The free-start collision attack
requires $2^{32}$ computations for all digests. The free-start preimage
attack requires around $2^{n/2}$ for NaSHA-n1. The attacks show a weakness
in the compression function of NaSHA, yet they do not contradict the
NIST security requirements.},
}
</bibtex>

<bibtex>
@misc{cryptoeprint:2008:519,
author = {Li Ji and Xu Liangyu and Guan Xu},
title = {Collision attack on NaSHA-512},
howpublished = {Cryptology ePrint Archive, Report 2008/519},
year = {2008},
url = {http://eprint.iacr.org/2008/519.pdf},
abstract = {The hash function NaSHA is a new algorithm proposed for SHA-3. It follows the wide-pipe structure and compression function adopts quasigroup transformations. These properties of operation in quasigroup raise obstacles to analysis. However, The high probability difference to cause inner collision can be found in the quasigroup transformations. We propose a collision attack to NaSHA-512 with the complexity is 2^{192}, which is lower than the complexity of birthday attack to NaSHA-512. Using the similar method, we can find free-start collision on all versions with negligible complexity.},
}
</bibtex>

<bibtex>
@misc{cryptoeprint:2009:026,
author = {Zhimin Li and Daofeng Li},
title = {Collision Attack on NaSHA-384/512},
howpublished = {Cryptology ePrint Archive, Report 2009/026},
year = {2009},
url = {http://eprint.iacr.org/2009/026.pdf},
abstract = {In this paper, we present a collision attack on the hash function NaSHA for the output sizes 384-bit and 512-bit. This attack is based on the the weakness in the generate course of the state words and the fact that the quasigroup operation used in the compression function is only determined by partial state words. Its complexity is about $2^{128}$ (much lower than the complexity of the corresponding birthday attack) and its probability is more than $(1- \frac{2}{{2^{64} - 1}})^2$ ($\gg \frac{1}{2}$).},
}
</bibtex>

<bibtex>
@misc{MarkovskiMDG-eprint:2009:034,
author = {S. Markovski and A. Mileva and V. Dimitrova and D. Gligoroski},
title = {On a Conditional Collision Attack on NaSHA-512},
howpublished = {Cryptology ePrint Archive, Report 2009/034},
year = {2009},
url = {http://eprint.iacr.org/2009/034.pdf},
abstract = {A collision attack on NaSHA-512 was proposed by L. Ji et al. The claimed complexity of the attack is $2^{192}$. The proposed attack is realized by using a suitable differential pattern. In this note we show that the correct result that can be inferred from their differential pattern is in fact a conditional one. It can be stated correctly as follows: A collision attack on NaSHA-512 of complexity $k=1,2,\dots,2^{320}$ can be performed with an unknown probability of success $p_k$, where $ 0\le p_1\le p_2\le p_{2^{320}}\le 1$. Consequently, the attack proposed by L. Ji et al. can be considered only as a direction how a possible collision attack on NaSHA-512 could be realized. The birthday attack remains the best possible attack on NaSHA-512.}
}
</bibtex>

The SHA-3 Zoo

2009-02-18T08:12:07Z

SThomsen: SHAMATA withdrawn

The SHA-3 Zoo (work in progress) is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (see also [http://en.wikipedia.org/wiki/SHA-3 here]). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates. Another categorization of the SHA-3 submissions can be found [http://eprint.iacr.org/2008/511.pdf here].
 
The idea of the SHA-3 Zoo is to give a good overview of cryptanalytic results. We try to avoid additional judgement whether a submission is broken. The answer to this question is left to NIST. However, we categorize the cryptanalytic results by their impact from very theoretic to practical attacks. A detailed description is given in [[Cryptanalysis Categories]].

At this time, 56 out of 64 submissions to the SHA-3 competition are publicly known and available. 51 [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html submissions] have advanced to the first round.
So far, 10 out of 51 first round candidates have been officially conceded broken or withdrawn by the designers.

The following table should give a first impression on the remaining SHA-3 candidates. It shows only the best known attack, more detailed results are collected at the individual hash function pages. A description of the main table is given [[Cryptanalysis_Categories#Main_Cryptanalysis_Table | here]].

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120"| Best Attack on Main NIST Requirements !! width="120"| Best Attack on other Hash Requirements
|-
| [[ARIRANG]] || Jongin Lim || ||
|-
| [[AURORA]] || Masahiro Fujita || ||
|-
| [[BLAKE]] || Jean-Philippe Aumasson || ||
|-
| [[Blender]] || Colin Bradbury || style="background:orange" | preimage ||
|-
| [[Blue Midnight Wish]] || Svein Johan Knapskog || ||
|-
| [[Cheetah]] || Dmitry Khovratovich || || length-extension
|-
| [[CHI]] || Phillip Hawkes || ||
|-
| [[CRUNCH]] || Jacques Patarin || || length-extension
|-
| [[CubeHash]] || Daniel J. Bernstein || style="background:greenyellow" | preimage ||
|-
| [[Dynamic SHA]] || Xu Zijie || || length-extension
|-
| [[Dynamic SHA2]] || Xu Zijie || || length-extension
|-
| [[ECHO]] || Henri Gilbert || ||
|-
| [[ECOH]] || Daniel R. L. Brown || ||
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || Danilo Gligoroski || style="background:yellow" | preimage ||
|-
| [[EnRUPT]] || Sean O’Neil || style="background:red" | collision ||
|-
| [[ESSENCE]] || Jason Worth Martin || ||
|-
| [[FSB (SHA-3 submission) | FSB]] || Matthieu Finiasz || ||
|-
| [[Fugue]] || Charanjit S. Jutla || ||
|-
| [[Groestl|Grøstl]] || Lars R. Knudsen || ||
|-
| [[Hamsi]] || Ozgul Kucuk || ||
|-
| [[JH]] || Hongjun Wu || style="background:greenyellow" | preimage ||
|-
| [[Keccak]] || The Keccak Team || ||
|-
| [[LANE]] || Sebastiaan Indesteege || ||
|-
| [[Lesamnta]] || Hirotaka Yoshida || ||
|-
| [[Luffa]] || Dai Watanabe || ||
|-
| [[LUX]] || Ivica Nikolic || ||
|-
| [[MCSSHA-3]] || Mikhail Maslennikov || style="background:orange" | collision ||
|-
| [[MD6]] || Ronald L. Rivest || ||
|-
| [[NaSHA]] || Smile Markovski || style="background:orange" | collision ||
|-
| [[SANDstorm]] || Rich Schroeppel || ||
|-
| [[Sarmal]] || Kerem Varici || style="background:yellow" | preimage ||
|-
| [[Sgàil]] || Peter Maxwell|| style="background:red" | collision ||
|-
| [[Shabal]] || Jean-Francois Misarsky || ||
|-
| [[SHAvite-3]] || Orr Dunkelman || ||
|-
| [[SIMD]] || Gaetan Leurent || ||
|-
| [[Skein]] || Bruce Schneier || ||
|-
| [[Spectral Hash]] || Cetin Kaya Koc || ||
|-
| [[SWIFFTX]] || Daniele Micciancio || ||
|-
| [[TIB3]] || Daniel Penazzi || style="background:yellow" | collision ||
|-
| [[Twister]] || Michael Gorski || style="background:yellow" | 2nd preimage ||
|-
| [[Vortex (SHA-3 submission)|Vortex]] || Michael Kounavis || style="background:yellow" | preimage ||
|}

The following hash functions have been submitted to the NIST competition but did not advance to the first round, or have been conceded broken or withdrawn by the designers:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120" | Status !! width="120" | Best Attack on Main NIST Requirements
|-
| [[Abacus]] || Neil Sholer || conceded broken || style="background:orange" | 2nd-preimage
|-
| [[Boole]] || Greg Rose || conceded broken || style="background:red" | collision
|-
| [[DCH]] || David A. Wilson || conceded broken || style="background:red" | collision
|-
| [[HASH 2X]] || Jason Lee || not in round 1 || style="background:red" | 2nd-preimage
|-
| [[Khichidi-1]] || M. Vidyasagar || conceded broken || style="background:red" | collision
|-
| [[Maraca]] || Robert J. Jenkins || not in round 1 || style="background:red" | preimage
|-
| [[MeshHash]] || Björn Fay || conceded broken || style="background:orange" | 2nd preimage
|-
| [[NKS2D]] || Geoffrey Park || not in round 1 || style="background:red" | collision
|-
| [[Ponic]] || Peter Schmidt-Nielsen || not in round 1 || style="background:yellow" | 2nd-preimage
|-
| [[SHAMATA]] || Orhun Kara || withdrawn || |
|-
| [[StreamHash]] || Michal Trojnara || conceded broken || style="background:red" | collision
|-
| [[Tangle]] || Rafael Alvarez || conceded broken || style="background:red" | collision
|-
| [[WaMM]] || John Washburn || conceded broken || style="background:red" | collision
|-
| [[Waterfall]] || Bob Hattersley || conceded broken || style="background:orange" | collision
|-
| [[ZK-Crypt]] || Carmi Gressel || not in round 1 ||
|-
|}

Your analysis is not mentioned? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

The SHA-3 Zoo

2009-01-30T14:35:20Z

SThomsen: Abacus withdrawn

The SHA-3 Zoo (work in progress) is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (see also [http://en.wikipedia.org/wiki/SHA-3 here]). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates. Another categorization of the SHA-3 submissions can be found [http://www.uni-weimar.de/cms/fileadmin/medien/medsicherheit/Research/SHA3/Classification_of_the_SHA-3_Candidates.pdf here].
 
The idea of the SHA-3 Zoo is to give a good overview of cryptanalytic results. We try to avoid additional judgement whether a submission is broken. The answer to this question is left to NIST. However, we categorize the cryptanalytic results by their impact from very theoretic to practical attacks. A detailed description is given in [[Cryptanalysis Categories]].

At this time, 55 out of 64 submissions to the SHA-3 competition are publicly known and available. 51 [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html submissions] have advanced to the first round.
So far, 9 out of 51 first round candidates have been officially conceded broken or withdrawn by the designers.

The following table should give a first impression on the remaining SHA-3 candidates. It shows only the best known attack, more detailed results are collected at the individual hash function pages. A description of the main table is given [[Cryptanalysis_Categories#Main_Cryptanalysis_Table | here]].

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120"| Best Attack on Main NIST Requirements !! width="120"| Best Attack on other Hash Requirements
|-
| [[ARIRANG]] || Jongin Lim || ||
|-
| [[AURORA]] || Masahiro Fujita || ||
|-
| [[BLAKE]] || Jean-Philippe Aumasson || ||
|-
| [[Blender]] || Colin Bradbury || style="background:orange" | preimage ||
|-
| [[Blue Midnight Wish]] || Svein Johan Knapskog || ||
|-
| [[Cheetah]] || Dmitry Khovratovich || || length-extension
|-
| [[CHI]] || Phillip Hawkes || ||
|-
| [[CRUNCH]] || Jacques Patarin || || length-extension
|-
| [[CubeHash]] || Daniel J. Bernstein || style="background:greenyellow" | preimage ||
|-
| [[Dynamic SHA]] || Xu Zijie || || length-extension
|-
| [[Dynamic SHA2]] || Xu Zijie || || length-extension
|-
| [[ECHO]] || Henri Gilbert || ||
|-
| [[ECOH]] || Daniel R. L. Brown || ||
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || Danilo Gligoroski || style="background:yellow" | preimage ||
|-
| [[EnRUPT]] || Sean O’Neil || style="background:red" | collision ||
|-
| [[ESSENCE]] || Jason Worth Martin || ||
|-
| [[FSB (SHA-3 submission) | FSB]] || Matthieu Finiasz || ||
|-
| [[Fugue]] || Charanjit S. Jutla || ||
|-
| [[Groestl|Grøstl]] || Lars R. Knudsen || ||
|-
| [[Hamsi]] || Ozgul Kucuk || ||
|-
| [[JH]] || Hongjun Wu || style="background:greenyellow" | preimage ||
|-
| [[Keccak]] || The Keccak Team || ||
|-
| [[LANE]] || Sebastiaan Indesteege || ||
|-
| [[Lesamnta]] || Hirotaka Yoshida || ||
|-
| [[Luffa]] || Dai Watanabe || ||
|-
| [[LUX]] || Ivica Nikolic || ||
|-
| [[MCSSHA-3]] || Mikhail Maslennikov || style="background:orange" | collision ||
|-
| [[MD6]] || Ronald L. Rivest || ||
|-
| [[NaSHA]] || Smile Markovski || style="background:orange" | collision ||
|-
| [[SANDstorm]] || Rich Schroeppel || ||
|-
| [[Sarmal]] || Kerem Varici || style="background:yellow" | preimage ||
|-
| [[Sgàil]] || Peter Maxwell|| style="background:red" | collision ||
|-
| [[Shabal]] || Jean-Francois Misarsky || ||
|-
| [[SHAMATA]] || Orhun Kara || ||
|-
| [[SHAvite-3]] || Orr Dunkelman || ||
|-
| [[SIMD]] || Gaetan Leurent || ||
|-
| [[Skein]] || Bruce Schneier || ||
|-
| [[Spectral Hash]] || Cetin Kaya Koc || ||
|-
| [[SWIFFTX]] || Daniele Micciancio || ||
|-
| [[TIB3]] || Daniel Penazzi || style="background:yellow" | collision ||
|-
| [[Twister]] || Michael Gorski || style="background:yellow" | 2nd preimage ||
|-
| [[Vortex (SHA-3 submission)|Vortex]] || Michael Kounavis || style="background:yellow" | preimage ||
|}

The following hash functions have been submitted to the NIST competition but did not advance to the first round or have been conceded broken by the designers:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120" | Status !! width="120" | Best Attack on Main NIST Requirements
|-
| [[Abacus]] || Neil Sholer || conceded broken || style="background:orange" | 2nd-preimage
|-
| [[Boole]] || Greg Rose || conceded broken || style="background:red" | collision
|-
| [[DCH]] || David A. Wilson || conceded broken || style="background:red" | collision
|-
| [[HASH 2X]] || Jason Lee || not in round 1 || style="background:red" | 2nd-preimage
|-
| [[Khichidi-1]] || M. Vidyasagar || conceded broken || style="background:red" | collision
|-
| [[Maraca]] || Robert J. Jenkins || not in round 1 || style="background:red" | preimage
|-
| [[MeshHash]] || Björn Fay || conceded broken || style="background:orange" | 2nd preimage
|-
| [[NKS2D]] || Geoffrey Park || not in round 1 || style="background:red" | collision
|-
| [[Ponic]] || Peter Schmidt-Nielsen || not in round 1 || style="background:yellow" | 2nd-preimage
|-
| [[StreamHash]] || Michal Trojnara || conceded broken || style="background:red" | collision
|-
| [[Tangle]] || Rafael Alvarez || conceded broken || style="background:red" | collision
|-
| [[WaMM]] || John Washburn || conceded broken || style="background:red" | collision
|-
| [[Waterfall]] || Bob Hattersley || conceded broken || style="background:orange" | collision
|}

Your analysis is not mentioned? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

ESSENCE

2009-01-24T10:24:35Z

SThomsen: Observations of non-randomness in Essence compression function

SHAvite-3

2009-01-20T07:58:30Z

SThomsen: Peyrin's chosen-salt, chosen-counter, pseudo-collision on SHAvite-3

File:Peyrin-SHAvite-3.txt

2009-01-20T07:53:47Z

SThomsen:

The SHA-3 Zoo

2009-01-15T10:00:32Z

SThomsen:

The SHA-3 Zoo (work in progress) is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (see also [http://en.wikipedia.org/wiki/SHA-3 here]). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates. Another categorization of the SHA-3 submissions can be found [http://www.uni-weimar.de/cms/fileadmin/medien/medsicherheit/Research/SHA3/Classification_of_the_SHA-3_Candidates.pdf here].
 
The idea of the SHA-3 Zoo is to give a good overview of cryptanalytic results. We try to avoid additional judgement whether a submission is broken. The answer to this question is left to NIST. However, we categorize the cryptanalytic results by their impact from very theoretic to practical attacks. A detailed description is given in [[Cryptanalysis Categories]].

At this time, 55 out of 64 submissions to the SHA-3 competition are publicly known and available. 51 [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html submissions] have advanced to the first round.
So far, 8 out of 51 first round candidates have been officially conceded broken or withdrawn by the designers.

The following table should give a first impression on the remaining SHA-3 candidates. It shows only the best known attack, more detailed results are collected at the individual hash function pages. A description of the main table is given [[Cryptanalysis_Categories#Main_Cryptanalysis_Table | here]].

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120"| Best Attack on Main NIST Requirements !! width="120"| Best Attack on other Hash Requirements
|-
| [[Abacus]] || Neil Sholer || style="background:orange" | 2nd-preimage ||
|-
| [[ARIRANG]] || Jongin Lim || ||
|-
| [[AURORA]] || Masahiro Fujita || ||
|-
| [[BLAKE]] || Jean-Philippe Aumasson || ||
|-
| [[Blender]] || Colin Bradbury || style="background:orange" | preimage ||
|-
| [[Blue Midnight Wish]] || Svein Johan Knapskog || ||
|-
| [[Cheetah]] || Dmitry Khovratovich || || length-extension
|-
| [[CHI]] || Phillip Hawkes || ||
|-
| [[CRUNCH]] || Jacques Patarin || || length-extension
|-
| [[CubeHash]] || Daniel J. Bernstein || style="background:greenyellow" | preimage ||
|-
| [[Dynamic SHA]] || Xu Zijie || || length-extension
|-
| [[Dynamic SHA2]] || Xu Zijie || || length-extension
|-
| [[ECHO]] || Henri Gilbert || ||
|-
| [[ECOH]] || Daniel R. L. Brown || ||
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || Danilo Gligoroski || style="background:yellow" | preimage ||
|-
| [[EnRUPT]] || Sean O’Neil || style="background:red" | collision ||
|-
| [[ESSENCE]] || Jason Worth Martin || ||
|-
| [[FSB (SHA-3 submission) | FSB]] || Matthieu Finiasz || ||
|-
| [[Fugue]] || Charanjit S. Jutla || ||
|-
| [[Groestl|Grøstl]] || Lars R. Knudsen || ||
|-
| [[Hamsi]] || Ozgul Kucuk || ||
|-
| [[JH]] || Hongjun Wu || style="background:greenyellow" | preimage ||
|-
| [[Keccak]] || The Keccak Team || ||
|-
| [[LANE]] || Sebastiaan Indesteege || ||
|-
| [[Lesamnta]] || Hirotaka Yoshida || ||
|-
| [[Luffa]] || Dai Watanabe || ||
|-
| [[LUX]] || Ivica Nikolic || ||
|-
| [[MCSSHA-3]] || Mikhail Maslennikov || style="background:yellow" | collision ||
|-
| [[MD6]] || Ronald L. Rivest || ||
|-
| [[NaSHA]] || Smile Markovski || style="background:orange" | collision ||
|-
| [[SANDstorm]] || Rich Schroeppel || ||
|-
| [[Sarmal]] || Kerem Varici || style="background:yellow" | preimage ||
|-
| [[Sgàil]] || Peter Maxwell|| style="background:red" | collision ||
|-
| [[Shabal]] || Jean-Francois Misarsky || ||
|-
| [[SHAMATA]] || Orhun Kara || ||
|-
| [[SHAvite-3]] || Orr Dunkelman || ||
|-
| [[SIMD]] || Gaetan Leurent || ||
|-
| [[Skein]] || Bruce Schneier || ||
|-
| [[Spectral Hash]] || Cetin Kaya Koc || ||
|-
| [[SWIFFTX]] || Daniele Micciancio || ||
|-
| [[TIB3]] || Daniel Penazzi || ||
|-
| [[Twister]] || Michael Gorski || style="background:yellow" | 2nd preimage ||
|-
| [[Vortex (SHA-3 submission)|Vortex]] || Michael Kounavis || style="background:yellow" | preimage ||
|}

The following hash functions have been submitted to the NIST competition but did not advance to the first round or have been conceded broken by the designers:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120" | Status !! width="120" | Best Attack on Main NIST Requirements
|-
| [[Boole]] || Greg Rose || conceded broken || style="background:red" | collision
|-
| [[DCH]] || David A. Wilson || conceded broken || style="background:red" | collision
|-
| [[HASH 2X]] || Jason Lee || not in round 1 || style="background:red" | 2nd-preimage
|-
| [[Khichidi-1]] || M. Vidyasagar || conceded broken || style="background:red" | collision
|-
| [[Maraca]] || Robert J. Jenkins || not in round 1 || style="background:red" | preimage
|-
| [[MeshHash]] || Björn Fay || conceded broken || style="background:orange" | 2nd preimage
|-
| [[NKS2D]] || Geoffrey Park || not in round 1 || style="background:red" | collision
|-
| [[Ponic]] || Peter Schmidt-Nielsen || not in round 1 || style="background:yellow" | 2nd-preimage
|-
| [[StreamHash]] || Michal Trojnara || conceded broken || style="background:red" | collision
|-
| [[Tangle]] || Rafael Alvarez || conceded broken || style="background:red" | collision
|-
| [[WaMM]] || John Washburn || conceded broken || style="background:red" | collision
|-
| [[Waterfall]] || Bob Hattersley || conceded broken || style="background:orange" | collision
|}

Your analysis is not mentioned? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

NaSHA

2009-01-15T10:00:06Z

SThomsen: Memory requirements for the 2^128 collision attack are negligible (according to authors)

== The algorithm ==

* Author(s): Smile Markovski, Aleksandra Mileva
* Website: [http://inf.ugd.edu.mk/images/stories/file/Mileva/Nasha.htm http://inf.ugd.edu.mk/images/stories/file/Mileva/Nasha.htm]
* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/NaSHA.zip NaSHA.zip]

<bibtex>
@misc{sha3MM08,
author = {Smile Markovski and Aleksandra Mileva },
title = {2.B.1 Algorithm Specification},
url = {http://inf.ugd.edu.mk/images/stories/file/Mileva/part2b1.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| | free-start collision || compression || all || || 232 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| | free-start preimage || compression || 224,256 || || ~2128 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| | free-start preimage || compression || 384,512 || || ~2256 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| | free-start collision || compression || all || || - || - || [http://eprint.iacr.org/2008/519.pdf Ji,Liangyu,Xu]
|-
| style="background:yellow" | collision || hash || 512 || || 2192 || ? || [http://eprint.iacr.org/2008/519.pdf Ji,Liangyu,Xu]
|-
| style="background:orange" | collision || hash || 384,512 || || 2128 || - || [http://eprint.iacr.org/2009/026.pdf Z. Li, D. Li]
|-
|}

A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

<bibtex>
@misc{nashaNK08,
author = {Ivica Nikolić and Dmitry Khovratovich},
title = {Free-start attacks on NaSHA},
url = {http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf},
howpublished = {Available online},
year = {2008},
abstract = {We present a free-start collision and a free-start preimage
attack on NaSHA. The attacks exploit the fact that when the state, obtained
after the linear transformation, is only partially fixed then the
quasigroup operations are fully determined. The free-start collision attack
requires $2^{32}$ computations for all digests. The free-start preimage
attack requires around $2^{n/2}$ for NaSHA-n1. The attacks show a weakness
in the compression function of NaSHA, yet they do not contradict the
NIST security requirements.},
}
</bibtex>

<bibtex>
@misc{cryptoeprint:2008:519,
author = {Li Ji and Xu Liangyu and Guan Xu},
title = {Collision attack on NaSHA-512},
howpublished = {Cryptology ePrint Archive, Report 2008/519},
year = {2008},
url = {http://eprint.iacr.org/2008/519.pdf},
abstract = {The hash function NaSHA is a new algorithm proposed for SHA-3. It follows the wide-pipe structure and compression function adopts quasigroup transformations. These properties of operation in quasigroup raise obstacles to analysis. However, The high probability difference to cause inner collision can be found in the quasigroup transformations. We propose a collision attack to NaSHA-512 with the complexity is 2^{192}, which is lower than the complexity of birthday attack to NaSHA-512. Using the similar method, we can find free-start collision on all versions with negligible complexity.},
}
</bibtex>

<bibtex>
@misc{cryptoeprint:2009:026,
author = {Zhimin Li and Daofeng Li},
title = {Collision Attack on NaSHA-384/512},
howpublished = {Cryptology ePrint Archive, Report 2009/026},
year = {2009},
url = {http://eprint.iacr.org/2009/026.pdf},
abstract = { In this paper, we present a collision attack on the hash function NaSHA for the output sizes 384-bit and 512-bit. This attack is based on the the weakness in the generate course of the state words and the fact that the quasigroup operation used in the compression function is only determined by partial state words. Its complexity is about $2^{128}$ (much lower than the complexity of the corresponding birthday attack) and its probability is more than $(1- \frac{2}{{2^{64} - 1}})^2$ ($\gg \frac{1}{2}$).},
}
</bibtex>

The SHA-3 Zoo

2009-01-08T13:24:55Z

SThomsen: DCH, Khichidi-1, MeshHash, and Tangle conceded broken according to http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html

The SHA-3 Zoo (work in progress) is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (see also [http://en.wikipedia.org/wiki/SHA-3 here]). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates. Another categorization of the SHA-3 submissions can be found [http://www.uni-weimar.de/cms/fileadmin/medien/medsicherheit/Research/SHA3/Classification_of_the_SHA-3_Candidates.pdf here].
 
The idea of the SHA-3 Zoo is to give a good overview of cryptanalytic results. We try to avoid additional judgement whether a submission is broken. The answer to this question is left to NIST. However, we categorize the cryptanalytic results by their impact from very theoretic to practical attacks. A detailed description is given in [[Cryptanalysis Categories]].

At this time, 55 out of 64 submissions to the SHA-3 competition are publicly known and available. 51 [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html submissions] have advanced to the first round.
So far, 3 out of 51 first round candidates have been officially conceded broken or withdrawn by the designers.

The following table should give a first impression on the remaining SHA-3 candidates. It shows only the best known attack, more detailed results are collected at the individual hash function pages. A description of the main table is given [[Cryptanalysis_Categories#Main_Cryptanalysis_Table | here]].

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120"| Best Attack on Main NIST Requirements !! width="120"| Best Attack on other Hash Requirements
|-
| [[Abacus]] || Neil Sholer || style="background:orange" | 2nd-preimage ||
|-
| [[ARIRANG]] || Jongin Lim || ||
|-
| [[AURORA]] || Masahiro Fujita || ||
|-
| [[BLAKE]] || Jean-Philippe Aumasson || ||
|-
| [[Blender]] || Colin Bradbury || style="background:orange" | preimage ||
|-
| [[Blue Midnight Wish]] || Svein Johan Knapskog || ||
|-
| [[Cheetah]] || Dmitry Khovratovich || || length-extension
|-
| [[CHI]] || Phillip Hawkes || ||
|-
| [[CRUNCH]] || Jacques Patarin || ||
|-
| [[CubeHash]] || Daniel J. Bernstein || style="background:greenyellow" | preimage ||
|-
| [[Dynamic SHA]] || Xu Zijie || || length-extension
|-
| [[Dynamic SHA2]] || Xu Zijie || || length-extension
|-
| [[ECHO]] || Henri Gilbert || ||
|-
| [[ECOH]] || Daniel R. L. Brown || ||
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || Danilo Gligoroski || style="background:yellow" | preimage ||
|-
| [[EnRUPT]] || Sean O’Neil || style="background:red" | collision ||
|-
| [[ESSENCE]] || Jason Worth Martin || ||
|-
| [[FSB (SHA-3 submission) | FSB]] || Matthieu Finiasz || ||
|-
| [[Fugue]] || Charanjit S. Jutla || ||
|-
| [[Groestl|Grøstl]] || Lars R. Knudsen || ||
|-
| [[Hamsi]] || Ozgul Kucuk || ||
|-
| [[JH]] || Hongjun Wu || style="background:greenyellow" | preimage ||
|-
| [[Keccak]] || The Keccak Team || ||
|-
| [[LANE]] || Sebastiaan Indesteege || ||
|-
| [[Lesamnta]] || Hirotaka Yoshida || ||
|-
| [[Luffa]] || Dai Watanabe || ||
|-
| [[LUX]] || Ivica Nikolic || ||
|-
| [[MCSSHA-3]] || Mikhail Maslennikov || style="background:yellow" | collision ||
|-
| [[MD6]] || Ronald L. Rivest || ||
|-
| [[NaSHA]] || Smile Markovski || style="background:yellow" | collision ||
|-
| [[SANDstorm]] || Rich Schroeppel || ||
|-
| [[Sarmal]] || Kerem Varici || style="background:yellow" | preimage ||
|-
| [[Sgàil]] || Peter Maxwell|| style="background:red" | collision ||
|-
| [[Shabal]] || Jean-Francois Misarsky || ||
|-
| [[SHAMATA]] || Orhun Kara || ||
|-
| [[SHAvite-3]] || Orr Dunkelman || ||
|-
| [[SIMD]] || Gaetan Leurent || ||
|-
| [[Skein]] || Bruce Schneier || ||
|-
| [[Spectral Hash]] || Cetin Kaya Koc || ||
|-
| [[StreamHash]] || Michal Trojnara || style="background:red" | collision ||
|-
| [[SWIFFTX]] || Daniele Micciancio || ||
|-
| [[TIB3]] || Daniel Penazzi || ||
|-
| [[Twister]] || Michael Gorski || style="background:yellow" | 2nd preimage ||
|-
| [[Vortex (SHA-3 submission)|Vortex]] || Michael Kounavis || style="background:yellow" | preimage ||
|}

The following hash functions have been submitted to the NIST competition but did not advance to the first round or have been conceded broken by the designers:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="160" | Principal Submitter !! width="120" | Status !! width="120" | Best Attack on Main NIST Requirements
|-
| [[Boole]] || Greg Rose || conceded broken || style="background:red" | collision
|-
| [[DCH]] || David A. Wilson || conceded broken || style="background:red" | collision
|-
| [[HASH 2X]] || Jason Lee || not in round 1 || style="background:red" | 2nd-preimage
|-
| [[Khichidi-1]] || M. Vidyasagar || conceded broken || style="background:red" | collision
|-
| [[Maraca]] || Robert J. Jenkins || not in round 1 || style="background:yellow" | collision
|-
| [[MeshHash]] || Björn Fay || conceded broken || style="background:orange" | 2nd preimage
|-
| [[NKS2D]] || Geoffrey Park || not in round 1 || style="background:red" | collision
|-
| [[Ponic]] || Peter Schmidt-Nielsen || not in round 1 || style="background:yellow" | 2nd-preimage
|-
| [[Tangle]] || Rafael Alvarez || conceded broken || style="background:red" | collision
|-
| [[WaMM]] || John Washburn || conceded broken || style="background:red" | collision
|-
| [[Waterfall]] || Bob Hattersley || conceded broken || style="background:orange" | collision
|}

Your analysis is not mentioned? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

Talk:The SHA-3 Zoo

2008-12-19T09:07:34Z

SThomsen: Near-collision attack on BMW is on the compression function, not the hash function

I'm thinking about introducing another column to the list of submissions to provide a rough, overall classification of the candidates (e.g. classical Merkle-Damgaard vs. HAIFA vs. sponge vs. tree-based vs. streaming vs. ...), motivated by private messages I've got comparing the current SHA-3 Zoo with my old hash lounge.

However, finding the most appropriate category for some submissions may be a tough task; paradigms may be so distorted as to be nearly unrecognizable. Still, other candidates exhibit a much more transparent structure, and I think this information may be useful (e.g. comparing submissions that fall on distinct categories may not be as fair as comparing functions that share a high-level structure).

Would such a modification be welcome to the SHA-3 Zoo contributors?

Paulo.

I think this would be a lot of effort for a relatively minor added value; as you observe, many candidates are likely to use "uncategorizable" modes of operations. How one would classify CubeHash? It has similarities with a sponge constructions, but is not a sponge in general. Also, both MD6 and ESSENCE have a tree construction, but with different arities, parameters, etc. Finding the best tradeoff precision/readability seems difficult...

JP

Well, I don't see it as too much effort -- for me at any rate; I'm not asking that somebody else do the hard work ☺. Rather, I think it's part of trying to understand how each submission works, and it could also suggest lines of attack (particularly where the actual functions deviate from previously analyzed constructions). Besides, in cases where the authors disagree of a tentative category it might shed new light on those authors' original intent.

Paulo.

Addendum: as far as I could tell, the overall structure of the currently known proposals seems to be the following (disclaimer: I may be completely mistaken in many cases): 

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="150"| Hash Function Name !! width="150"| Status !! width="150"| [[External Cryptanalysis Categories| External Cryptanalysis]]!! width="150"| Tentative Classification
|-
| [[Abacus]] || submitted || none || ? [?]
|-
| [[ARIRANG]] || submitted || none || ? [?]
|-
| [[AURORA]] || submitted || none || ? [?]
|-
| [[BLAKE]] || submitted || none || HAIFA/? [narrow pipe]
|-
| [[Blender]] || submitted || none || ? [?]
|-
| [[Blue Midnight Wish]] || submitted || yes || sponge? [wide pipe]
|-
| <s>[[Boole]]</s> || submitted || ☠|| streaming
|-
| [[Cheetah]] || submitted || none || ? [?]
|-
| [[CHI]] || submitted || none || Merkle-Damgård/Davies-Meyer [wide pipe]
|-
| [[CRUNCH]] || submitted || none || Merkle-Damgård/concatenate-permute-truncate [narrow pipe]
|-
| [[CubeHash]] || submitted || yes || sponge [wide pipe]
|-
| <s>[[DCH]]</s> || submitted || ☠|| Merkle-Damgård/Miyaguchi-Preneel [narrow pipe]
|-
| [[Dynamic SHA]] || submitted || none || ? [?]
|-
| [[Dynamic SHA2]] || submitted || none || ? [?]
|-
| [[ECHO]] || submitted || none || ? [?]
|-
| [[ECOH]] || submitted || none || ? [?]
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || submitted || yes || streaming
|-
| <s>[[EnRUPT]]</s> || submitted || ☠|| streaming
|-
| [[ESSENCE]] || submitted || none || Merkle tree [narrow pipe]
|-
| [[FSB (SHA-3 submission) | FSB]] || submitted || none || Merkle-Damgård/concatenate-permute-truncate [wide pipe]
|-
| [[Fugue]] || submitted || none || sponge? [wide pipe]
|-
| [[Groestl|Grøstl]] || submitted || yes || sponge? Merkle-Damgård/Davies-Meyer? [wide pipe]
|-
| [[Hamsi]] || submitted || none || ? [?]
|-
| <s>[[HASH 2X]]</s> || submitted || ☠|| streaming?
|-
| [[JH]] || submitted || none || sponge [wide pipe]
|-
| [[Keccak]] || submitted || none || sponge [wide pipe]
|-
| [[Khichidi-1]] || submitted || none || ? [?]
|-
| [[LANE]] || submitted || none || HAIFA/concatenate-permute-truncate or Damgård interleaving [narrow pipe]
|-
| [[Lesamnta]] || submitted || none || ? [?]
|-
| [[Luffa]] || submitted || none || ? [?]
|-
| [[LUX]] || submitted || none || ? [?]
|-
| [[Maraca]] || submitted || none || sponge? [wide pipe]
|-
| <s>[[MCSSHA-3]]</s> || submitted || ☠|| streaming
|-
| [[MD6]] || submitted || yes || bounded-height Merkle tree [wide pipe]
|-
| [[MeshHash]] || submitted || none || ? [?]
|-
| [[NaSHA]] || submitted || none || sponge? [narrow pipe]
|-
| [[SANDstorm]] || submitted || none || ? [?]
|-
| <s>[[NKS2D]]</s> || submitted || ☠|| cellular automaton
|-
| [[Ponic]] || submitted || yes || streaming
|-
| [[Sarmal]] || submitted || yes || HAIFA/Davies-Meyer [narrow pipe]
|-
| <s>[[Sgàil]]</s> || submitted || ☠|| Merkle-Damgård/Davies-Meyer [wide pipe]
|-
| [[Shabal]] || submitted || none || ? [?]
|-
| [[SHAMATA]] || submitted || none || sponge [wide pipe]
|-
| [[SHAvite-3]] || submitted || none || ? [?]
|-
| [[SIMD]] || submitted || none || ? [?]
|-
| [[Skein]] || submitted || none || Merkle-Damgård/UBI? Merkle tree? [narrow pipe]
|-
| [[Spectral Hash]] || submitted || yes || Merkle-Damgård/prism? [narrow pipe]
|-
| [[SWIFFTX]] || submitted || none || HAIFA/concatenate-permute-truncate [wide pipe]
|-
| [[Tangle]] || submitted || none || ? [?]
|-
| [[TIB3]] || submitted || none || ? [?]
|-
| [[Twister]] || submitted || none || ? [?]
|-
| [[Vortex (SHA-3 submission)|Vortex]] || submitted || yes || Merkle-Damgård/Vortex-block? [wide pipe]
|-
| <s>[[WaMM]]</s> || submitted || ☠|| sponge [wide pipe]
|-
| [[Waterfall]] || submitted || none || streaming
|}

I'm in favour of adding more infos to this page. Seems like a good first shot. But surely we have to put a disclaimer to this category saying something like "this column can never we entirely correct as we would need almost 64 categories...".

Regarding your current categorization. Why not distinguish designs that are based on a small number of permutations from designs based on a huge number of permutations (e.g. block-cipher based). This seems a crucial difference to me.
On the other hand, do we really want to distinguish HAIFA from Merkle-Damgaard? The former is an extension of the later.
Also, what is your way to distinguish between sponge and streaming?

-Christian

Oh, I'm definitely thinking about adding a disclaimer. Regarding HAIFA vs. MD, I wrote HAIFA when the authors explicitly state so in the documentation. I tend to call "sponge" a construction that inserts a message in "blocks" (related to the abstract design) in a "simple" way (e.g. via some block-oriented group operation), and "stream" a construction oriented toward "words" (related to popular target platforms) mixed into the state through a "complicated" operation (I admit this is rather informal to say the least); also, I again adhere to the authors' statement when they claim a design is streaming. As for permutations vs. block ciphers, I've been thinking about this... but perhaps it's better to discuss the subject privately before, so I can check my own understanding of a few concepts. And of course I'm entirely open to revising a classification if there is evidence of a mistaken prior assessment.

Paulo.

We can follow Orr and say that "everything is HAIFA" ;)

More seriously: more info would of course be valuable, but accurate information seems in this case difficult (and maybe impossible) to provide. All the functions are based on a compression function (whatever the designers say to sound original), then the variations are: how the iteration is performed? (linear or tree), how large is the state?, how many rounds are recommended and how many are broken? (it would be interesting to give this ratio, but often there's more than the "round" parameter, see eg CubeHash), are there additional inputs? (salt, key, counter, etc.).

The iteration mode seems to be linear in most of the submissions, so providing this info may not be that useful. However it could be interesting and easy to add a column "state bitsize". If we want to say how many rounds are broken, we'll reduce to the same problem as we have with the "external cryptanalysis" column with "what is broken".

JP

I just wish to say that the terminology about ''sponge'' sometimes seems to spread across things that are not sponge functions according to the definition in our paper [http://sponge.noekeon.org Sponge Functions]. I have not checked all the entries marked "sponge" in the table above, but I have some doubts about whether these hash functions actually use the sponge construction. For instance, I checked JH and it does not seem they use the sponge construction. Instead, they use MD and a compression function (built on top of a permutation). Also, RadioGatún seems to be sometimes described as a sponge function, when it is not, see [http://radiogatun.noekeon.org/index.html#notasponge].

Gilles

Hi, I agree with those saying that a categorization can never be exact. A possibility is to collect a list of headlines such as "Merkle-Damgård", "Sponge", "Block cipher-based", "Permutation-based" etc., and state an indication as to which degree each hash function can be said to fall into each category. As an example, we say that Grøstl is permutation-based, but as Paulo showed, it can also be seen as being block cipher-based, so on a scale from, e.g., 0-4, Grøstl may be permutation-based to a degree of 3, and block cipher-based to a degree of 1 (just an example!). It is "almost" an MD construction, but not quite, so we may say it is MD to a degree of 2 or 3. The question is whether such a categorization will be more fair, more useful, etc., than a true/false categorization.

However, my personal opinion is that we should avoid completely to categorize hash functions (except in 100% objective ways such as internal state size, message block size, status in the competition etc. - some of which you may also argue are not 100% objective). I also think we should not deem hash functions as being "broken" or "damaged", we should just link to all published results, and let people make up their own minds. I am assuming we did not build the SHA-3 Zoo in an attempt to have an influence on NIST's decisions.

/Søren

== new tables ==

This is a draft for the new tables to show the analysis and complexities of each hash function. The first table is shown at the main page, the entries of the second table are only shown at the Wiki page of each hash function.

Martin

main table:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="120"| Hash Name !! width="100"| Status !! width="100"| External Cryptanalysis !! width="100"| practical example !! width="100"| time*memory < generic !! width="100"| compr. calls < generic
|-
| [[Abacus]] || 1st round || style="background:orange" | yes || || X || X
|-
| [[ARIRANG]] || 1st round || none || || ||
|-
| [[AURORA]] || 1st round || none || || ||
|-
| [[BLAKE]] || 1st round || none || || ||
|-
| [[Blender]] || 1st round || none || || ||
|-
| [[Blue Midnight Wish]] || 1st round || style="background:green" | yes || || ||
|-
| [[Boole]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[Cheetah]] || 1st round || none || || ||
|-
| [[CHI]] || 1st round || none || || ||
|-
| [[CRUNCH]] || 1st round || none || || ||
|-
| [[CubeHash]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[DCH]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[Dynamic SHA]] || 1st round || none || || ||
|-
| [[Dynamic SHA2]] || 1st round || none || || ||
|-
| [[ECHO]] || 1st round || none || || ||
|-
| [[ECOH]] || 1st round || none || || ||
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[EnRUPT]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[ESSENCE]] || 1st round || none || || ||
|-
| [[FSB (SHA-3 submission) | FSB]] || 1st round || none || || ||
|-
| [[Fugue]] || 1st round || none || || ||
|-
| [[Groestl|Grøstl]] || 1st round || style="background:green" | yes || || ||
|-
| [[HASH 2X]] || submitted || style="background:black" | yes || X || X || X
|-
| [[Hamsi]] || 1st round || none || || ||
|-
| [[JH]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[Keccak]] || 1st round || none || || ||
|-
| [[Khichidi-1]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[LANE]] || 1st round || none || || ||
|-
| [[Lesamnta]] || 1st round || none || || ||
|-
| [[Luffa]] || 1st round || none || || ||
|-
| [[LUX]] || 1st round || style="background:green" | yes || || ||
|-
| [[Maraca]] || submitted || style="background:black" | yes || || ||
|-
| [[MCSSHA-3]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[MD6]] || 1st round || style="background:green" | yes || || ||
|-
| [[MeshHash]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[NaSHA]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[NKS2D]] || submitted || style="background:black" | yes || X || X || X
|-
| [[Ponic]] || submitted || style="background:black" | yes || || || X
|-
| [[SANDstorm]] || 1st round || none || || ||
|-
| [[Sarmal]] || 1st round || style="background:green" | yes || || ||
|-
| [[Sgàil]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[Shabal]] || 1st round || none || || ||
|-
| [[SHAMATA]] || 1st round || style="background:green" | yes || || ||
|-
| [[SHAvite-3]] || 1st round || none || || ||
|-
| [[SIMD]] || 1st round || none || || ||
|-
| [[Skein]] || 1st round || none || || ||
|-
| [[Spectral Hash]] || 1st round || style="background:green" | yes || || ||
|-
| [[StreamHash]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[SWIFFTX]] || 1st round || none || || ||
|-
| [[Tangle]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[TIB3]] || 1st round || none || || ||
|-
| [[Twister]] || 1st round || style="background:orange" | yes || || X || X
|-
| [[Vortex (SHA-3 submission)|Vortex]] || 1st round || style="background:yellow" | yes || || || X
|-
| [[WaMM]] || 1st round || style="background:red" | yes || X || X || X
|-
| [[Waterfall]] || 1st round || none || || ||
|}

caption for main table:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
! width="100"| color !! External Cryptanalysis or Status !! Explanation
|-
| || no external cryptanalysis || no external cryptanalysis for this hash function has been published
|-
| style="background:green" | || external cryptanalysis || external cryptanalysis published but does not violate the NIST requirements
|-
| style="background:yellow" | || compr. calls < generic || the number of compression function calls is below generic attacks for collision, 2nd preimage or preimage
|-
| style="background:orange" | || time*memory < generic || the time*memory product is below generic attacks for collision, 2nd preimage or preimage
|-
| style="background:red" | || practical example || a practical (collision) example is given for the hash function
|-
| style="background:black" | || not in round 1 || this hash function did not advance to round 1 of the NIST competition
|-
|}

Individual hash function tables:
{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" style="text-align:center"
|- style="background:#efefef;"
| Hash Function Name || Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements || Reference
|-
| Abacus || style="background:orange" | 2nd preimage || hash || ? || || 2344 || - || [http://web.mit.edu/dwilson/www/hash/abacus_attack.pdf Wilson]
|-
| Abacus || style="background:orange" | collision || hash || ? || || 2172 || - || [http://web.mit.edu/dwilson/www/hash/abacus_attack.pdf Wilson]
|-
| Abacus || style="background:orange" | 2nd preimage || hash || ? || || 2172 || - || [http://lj.streamclub.ru/papers/hash/abacus.pdf Nikolić,Khovratovich]
|-
| Blue Midnight Wish || | near collision || compression || all || || - || - || [http://www2.mat.dtu.dk/people/S.Thomsen/bmw/nc-compress.pdf Thomsen]
|-
| Boole || style="background:orange" | preimage || hash || all || || 29n/16 || - || [http://ehash.iaik.tugraz.at/uploads/2/2f/Boole.pdf Nikolić]
|-
| Boole || style="background:red" | collision || hash || 224,256 || || example, 234 || - || [http://ehash.iaik.tugraz.at/uploads/0/0b/BooleCollision.txt Mendel,Nad,Schläffer]
|-
| Boole || style="background:red" | collision || hash || 384,512 || || 266 || - || [http://ehash.iaik.tugraz.at/uploads/0/0b/BooleCollision.txt Mendel,Nad,Schläffer]
|-
| CubeHash || | observations || || all || 8/1 || || || [http://eprint.iacr.org/2008/486.pdf Aumasson,Meier,Naya-Plasencia,Peyrin]
|-
| CubeHash || style="background:yellow" | preimage || hash || 512 || || 2511 || 2508 || [http://ehash.iaik.tugraz.at/uploads/6/6c/Cubehash.pdf Khovratovich,Nikolić,Weinmann]
|-
| CubeHash || | preimage || hash || 512 || r/4 || 2496 || - || [http://ehash.iaik.tugraz.at/uploads/6/6c/Cubehash.pdf Khovratovich,Nikolić,Weinmann]
|-
| CubeHash || | preimage || hash || 512 || r/8 || 2480 || - || [http://ehash.iaik.tugraz.at/uploads/6/6c/Cubehash.pdf Khovratovich,Nikolić,Weinmann]
|-
| CubeHash || | collision || hash || 512 || 2/120 || example || - || [http://ehash.iaik.tugraz.at/uploads/a/a9/Cubehash.txt Aumasson]
|-
| DCH || style="background:red" | collision || hash || all || || 521 || - || [http://ehash.iaik.tugraz.at/uploads/9/9b/Dch.pdf Mendel,Lamberger]
|-
| DCH || style="background:red" | preimage || hash || all || || 521 || - || [http://ehash.iaik.tugraz.at/uploads/9/9b/Dch.pdf Mendel,Lamberger]
|-
| DCH || style="background:orange" | collision || hash || all || || 245 || 245 || [http://ehash.iaik.tugraz.at/uploads/b/b7/Dch1.pdf Khovratovich,Nikolić]
|-
| DCH || style="background:orange" | preimage || hash || all || || 245 || 245 || [http://ehash.iaik.tugraz.at/uploads/b/b7/Dch1.pdf Khovratovich,Nikolić]
|-
| DCH || style="background:yellow" | 2nd preimage || hash || 512 || || 2450 || ? || [http://web.mit.edu/dwilson/www/hash/ Rechberger]
|-
| Edon-R || | collision || compression || ? || || - || - || [http://ehash.iaik.tugraz.at/uploads/7/74/Edon.pdf Khovratovich,Nikolić,Weinmann]
|-
| Edon-R || | 2nd preimage || compression || ? || || - || - || [http://ehash.iaik.tugraz.at/uploads/7/74/Edon.pdf Khovratovich,Nikolić,Weinmann]
|-
| Edon-R || | preimage || compression || ? || || - || - || [http://ehash.iaik.tugraz.at/uploads/7/74/Edon.pdf Khovratovich,Nikolić,Weinmann]
|-
| Edon-R || style="background:yellow" | preimage || hash || ? || || 22n/3 || 22n/3 || [http://ehash.iaik.tugraz.at/uploads/7/74/Edon.pdf Khovratovich,Nikolić,Weinmann]
|-
| Edon-R || | multicollision (2K) || hash || 256,512 || || K*2n/2 || 2n/2 || [http://cryptography.hyperlink.cz/BMW/EDONR_analysis_vk.pdf Klima]
|-
| Edon-R || | multipreimage || hash || 256,512 || || ? || ? || [http://cryptography.hyperlink.cz/BMW/EDONR_analysis_vk.pdf Klima]
|-
| EnRUPT || style="background:yellow" | preimage || hash || 512 || || 2480 || 2480 || [http://ehash.iaik.tugraz.at/uploads/9/9b/Enrupt.pdf Khovratovich,Nikolić]
|-
| EnRUPT || style="background:red" | collision || hash || 256 || || example, 247 || - || [http://homes.esat.kuleuven.be/~sindeste/enrupt.html Indesteege]
|-
| Grøstl || | observation || block cipher || all || || || || [http://www.larc.usp.br/~pbarreto/Grizzly.pdf Barreto]
|-
| Hash 2X || style="background:red" | 2nd preimage || hash || ? || || example || - || [http://tibasicdev.wikidot.com/archives:hash-2x/comments/show#post-302617 Aumasson]
|-
| JH || | pseudo collision || compression || all || || - || - || [http://ehash.iaik.tugraz.at/uploads/a/a8/Jh1.txt Bagheri]
|-
| JH || | pseudo 2nd preimage || compression || all || || - || - || [http://ehash.iaik.tugraz.at/uploads/a/a8/Jh1.txt Bagheri]
|-
| JH || style="background:yellow" | preimage || hash || all || || 2510.3 || 2510.3 || [http://ehash.iaik.tugraz.at/uploads/d/da/Jh_preimage.pdf Mendel,Thomsen]
|-
| KhiChidi-1 || style="background:red" | collision || hash || 256 || || example || - || [http://ehash.iaik.tugraz.at/uploads/8/89/Khichidi-1.txt Mouha]
|-
| LUX || | collision || reduced hash || 224 || 3 blank rounds || - || - || [http://ehash.iaik.tugraz.at/uploads/3/36/Analysis_LUX_1.pdf Wu,Feng,Wu]
|-
| LUX || | near collision || reduced hash || 256 || 3 blank rounds || - || - || [http://ehash.iaik.tugraz.at/uploads/3/36/Analysis_LUX_1.pdf Wu,Feng,Wu]
|-
| LUX || | free-start collision || compression || ? || || - || - || [http://ehash.iaik.tugraz.at/uploads/3/36/Analysis_LUX_1.pdf Wu,Feng,Wu]
|-
| LUX || | free-start preimage || compression || ? || || 280 || - || [http://ehash.iaik.tugraz.at/uploads/3/36/Analysis_LUX_1.pdf Wu,Feng,Wu]
|-
| Maraca || | internal collision || internal state || 512 || || 2237 || 2230.5 || [http://ehash.iaik.tugraz.at/uploads/5/52/Maraca.pdf Canteaut,Naya-Plasencia]
|-
| MCSSHA-3 || style="background:yellow" | collision || hash || all || || 23n/8 || ? || [http://131002.net/data/papers/AN08.pdf Aumasson,Naya-Plasencia]
|-
| MCSSHA-3 || style="background:yellow" | 2nd preimage || hash || all || || 23n/4 || ? || [http://131002.net/data/papers/AN08.pdf Aumasson,Naya-Plasencia]
|-
| MD6 || | non-randomness || reduced compression || ? || 18 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Aumasson,Meier]
|-
| MD6 || | key-recovery || reduced compression || ? || 15 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Dinur,Shamir]
|-
| MeshHash || style="background:yellow" | 2nd preimage || hash || 256 || || 2194.3 || 2128 || [http://www.mat.dtu.dk/people/S.Thomsen/meshhash/2ndpreimage.pdf Thomsen]
|-
| MeshHash || style="background:yellow" | 2nd preimage || hash || 512 || || 2323.2 || 2256 || [http://www.mat.dtu.dk/people/S.Thomsen/meshhash/2ndpreimage.pdf Thomsen]
|-
| NaSHA || | free-start collision || compression || all || || 232 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| NaSHA || | free-start preimage || compression || 224,256 || || ~2128 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| NaSHA || | free-start preimage || compression || 384,512 || || ~2256 || ? || [http://ehash.iaik.tugraz.at/uploads/3/33/Free-start_attacks_on_Nasha.pdf Nikolić,Khovratovich]
|-
| NaSHA || | free-start collision || compression || all || || - || - || [http://eprint.iacr.org/2008/519.pdf Ji,Liangyu,Xu]
|-
| NaSHA || style="background:yellow" | collision || hash || 512 || || 2192 || ? || [http://eprint.iacr.org/2008/519.pdf Ji,Liangyu,Xu]
|-
| NKS2D || style="background:red" | collision || hash || 224 || || example || - || [http://ehash.iaik.tugraz.at/uploads/3/3f/NK2SD-224.txt De Cannière]
|-
| NKS2D || style="background:red" | collision || hash || 512 || || example || - || [http://ehash.iaik.tugraz.at/uploads/9/93/NK2SD-512.txt Enright]
|-
| Ponic || style="background:yellow" | 2nd preimage || hash || 512 || || 2265 || 2256 || [http://131002.net/data/papers/ponic.pdf Naya-Plasencia]
|-
| Sarmal || | preimage (salt size s) || hash || 512 || || max(2512-s,2256+s) || 2s || [http://ehash.iaik.tugraz.at/uploads/7/77/Sarmal.pdf Nikolić]
|-
| Sgàil || style="background:red" | collision || hash || ? || || example || - || [http://www.allicient.co.uk/2008/11/05/aww-psh/ Maxwell]
|-
| SHAMATA || | observation || block cipher || || || || || [http://www.uni-weimar.de/cms/fileadmin/medien/medsicherheit/Research/SHA3/Observations_for_SHAMATA.pdf Fleischmann,Gorski]
|-
| SHAMATA || | observation || block cipher || || || || || [http://www.uekae.tubitak.gov.tr/uekae_content_files/crypto/improved_analysis_of_Shamata-BC.pdf Atalay,Kara,Karakoc]
|-
| SpectralHash || | near collision || hash || 224,512 || reference impl. || example || - || [http://ehash.iaik.tugraz.at/uploads/2/27/Near_and_truncated_collisions_in_Spectral_Hash_%28shash----%29.txt Enright]
|-
| SpectralHash || | truncated collision || hash || 512 || reference impl. || example || - || [http://ehash.iaik.tugraz.at/uploads/2/27/Near_and_truncated_collisions_in_Spectral_Hash_%28shash----%29.txt Enright]
|-
| SpectralHash || | collision || hash || ? || reference impl. || example || - || [http://ehash.iaik.tugraz.at/uploads/6/64/Spectralhash.txt Bjørstad]
|-
| StreamHash || style="background:yellow" | collision || hash || all || || n/2*2n/4 || ? || [http://lj.streamclub.ru/papers/hash/streamhash.pdf Khovratovich,Nikolić]
|-
| StreamHash || style="background:yellow" | preimage || hash || all || || n/2*2n/2 || ? || [http://lj.streamclub.ru/papers/hash/streamhash.pdf Khovratovich,Nikolić]
|-
| StreamHash || style="background:red" | collision || hash || 256 || || example || - || [http://ehash.iaik.tugraz.at/uploads/7/7b/Streamhash.txt Bjørstad]
|-
| Tangle || | observation || || || || || || [http://ehash.iaik.tugraz.at/uploads/c/c9/Tangle_Observation.pdf Esmaeili]
|-
| Tangle || style="background:red" | collision || hash || all || || example, 213 - 228 || - || [http://www2.mat.dtu.dk/people/S.Thomsen/tangle/tangle-coll.pdf Thomsen]
|-
| Twister || | pseudo collision || compression || all || || 226.5 || 228 || [http://ehash.iaik.tugraz.at/uploads/d/dd/Twister_attack.pdf Mendel,Rechberger,Schläffer]
|-
| Twister || style="background:orange" | collision || hash || 512 || || 2252 || - || [http://ehash.iaik.tugraz.at/uploads/d/dd/Twister_attack.pdf Mendel,Rechberger,Schläffer]
|-
| Twister || style="background:yellow" | 2nd preimage || hash || 512 || || 2448 || 264 || [http://ehash.iaik.tugraz.at/uploads/d/dd/Twister_attack.pdf Mendel,Rechberger,Schläffer]
|-
| Vortex || | observation || || all || || || || [http://www.131002.net/data/papers/AD08.pdf Aumasson,Dunkelman]
|-
| Vortex || | pseudo collision || compression || all || || 2n/4 || - || [http://ehash.iaik.tugraz.at/uploads/5/5c/Vortex_Collisions_and_Preimages_note.txt Knudsen,Mendel,Rechberger,Thomsen]
|-
| Vortex || style="background:yellow" | preimage || hash || all || || 23n/4 || 2n/4 || [http://ehash.iaik.tugraz.at/uploads/5/5c/Vortex_Collisions_and_Preimages_note.txt Knudsen,Mendel,Rechberger,Thomsen]
|-
| Vortex || style="background:yellow" | collision || hash || 256 || || 2122.5 || 2122.5 || [http://ehash.iaik.tugraz.at/uploads/5/5c/Vortex_Collisions_and_Preimages_note.txt Knudsen,Mendel,Rechberger,Thomsen]
|-
| WaMM || style="background:red" | collision || hash || all || || example || - || [http://web.mit.edu/dwilson/www/hash/wamm.html Wilson]
|-
|}

caption for individual tables:

A dash (-) in the individual table means that the complexities are neglible. A question mark (?) means the information is not given or unclear.

The "Parameters/Variants" column gives the parameters for attacks on reduced variants. If the column is empty, the attack is on the recommended parameters of the designers.

The "Type of Analyses" column is left white, if the attack is on reduced variants or parts of the hash function.

Talk:The SHA-3 Zoo

2008-12-18T15:24:57Z

SThomsen:

Tangle

2008-12-16T17:23:50Z

SThomsen:

== The algorithm ==

* Author(s): Rafael Alvarez, Gary McGuire and Antonio Zamora

* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Tangle.zip Tangle.zip]

<bibtex>
@misc{sha3AlvarezMZ08,
author = {Rafael Alvarez, Gary McGuire and Antonio Zamora},
title = {The Tangle Hash Function},
url = {http://ehash.iaik.tugraz.at/uploads/4/40/Tangle.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

<bibtex>
@misc{Thomsen-tangle-coll,
author = {Søren S. Thomsen},
title = {Untangled},
url = {http://www2.mat.dtu.dk/people/S.Thomsen/tangle/tangle-coll.pdf},
howpublished = {Available online},
year = {2008},
abstract = {We describe a collision attack on all variants of the SHA-3 candidate Tangle. Practical collisions have been found, and memory requirements are negligible. The time complexity of the attack ranges from a few seconds (equivalent to 2^13-2^19 compression function evaluations) for all except the longest variant, to several minutes, or about 2^28 compression function evaluations for the longest (1024-bit) variant.}
}
</bibtex>

The SHA-3 Zoo

2008-12-16T14:36:44Z

SThomsen:

Tangle

2008-12-16T14:36:07Z

SThomsen: Added cryptanalytic result on Tangle

SHA-3 submitters

2008-12-11T14:48:34Z

SThomsen:

Below, all (191) known SHA-3 candidate submitters are listed with affiliation and candidate algorithm. In many cases, the affiliations were found using [http://www.google.com Google], and hence may be outdated or otherwise erroneous. If you find errors, drop a line at sha3zoo@iaik.tugraz.at to let us know.

[[The_SHA-3_Zoo|Click here]] to go back to the SHA-3 Zoo main page.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="180"| Submitter name !! width="400"| Affiliation !! width="180"| Algorithm(s)
|-
| <nowiki>Benjamin Agre</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Toru Akishita</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Rafael Alvarez</nowiki> || University of Alicante, Spain || [[Tangle]]
|-
| <nowiki>Jørn Amundsen</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Elena Andreeva</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Adrian Antipa</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Yuriy Arbitman</nowiki> || ? || [[SWIFFTX]]
|-
| <nowiki>Adem Atalay</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Daniel Augot</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Jean-Philippe Aumasson</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Daniel V. Bailey</nowiki> || RSA Laboratories || [[MD6]]
|-
| <nowiki>Mihir Bellare</nowiki> || University of California San Diego, USA || [[Skein]]
|-
| <nowiki>Ryad Benadjila</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Dan Bernstein</nowiki> || University of Illinois at Chicago, USA || [[CubeHash]]
|-
| <nowiki>Guido Bertoni</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Eli Biham</nowiki> || Technion, Israel || [[SHAvite-3]]
|-
| <nowiki>Olivier Billet</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Alex Biryukov</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Charles Bouillaguet</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Colin Bradbury</nowiki> || ? || [[Blender]]
|-
| <nowiki>Emmanuel Bresson</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Daniel R. L. Brown</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Jon Callas</nowiki> || PGP Corporation || [[Skein]]
|-
| <nowiki>Matt Campagna</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Anne Canteaut</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Donghoon Chang</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Benoît Chevallier-Mames</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Christophe Clavier</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Michael Collins</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Christopher Crutchfield</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Joan Daemen</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Nathan Dautenhahn</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Christophe De Cannière</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]], [[Luffa]]
|-
| <nowiki>Cevahir Demirkıran</nowiki> || Universitat Autònoma de Barcelona, Spain || [[Spectral Hash]]
|-
| <nowiki>Yevgeniy Dodis</nowiki> || New York University, USA || [[MD6]]
|-
| <nowiki>Gil Dogon</nowiki> || Mobileye Inc., Israel || [[SWIFFTX]]
|-
| <nowiki>Tim Draelos</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Aleš Drápal</nowiki> || Charles University, Czech Republic || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Orr Dunkelman</nowiki> || École Normale Supérieure (Ulm), France || [[LANE]], [[SHAvite-3]]
|-
| <nowiki>Mohamed El-Hadedy</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Björn Fay</nowiki> || Justus Liebig-Universität, Germany || [[MeshHash]]
|-
| <nowiki>Niels Ferguson</nowiki> || Microsoft Corporation || [[Skein]]
|-
| <nowiki>Matthieu Finiasz</nowiki> || École Nationale Supérieure de Techniques Avancées, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Ewan Fleischmann</nowiki> || Bauhaus-University Weimar, Germany || [[Twister]]
|-
| <nowiki>Kermin Elliott Fleming</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Christian Forler</nowiki> || Sirrix AG || [[Twister]]
|-
| <nowiki>Pierre-Alain Fouque</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Thomas Fuhr</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Philippe Gaborit</nowiki> || Université de Limoges, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Praveen Gauravaram</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Henri Gilbert</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Danilo Gligoroski</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Michael Gorski</nowiki> || Bauhaus-University Weimar, Germany || [[Twister]]
|-
| <nowiki>Louis Goubin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Aline Gouget</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Shay Gueron</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Shai Halevi</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>William E. Hall</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Bob Hattersley</nowiki> || Opta Consulting || [[Waterfall]]
|-
| <nowiki>Phil Hawkes</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Luca Henzen</nowiki> || Eidgenössische Technische Hochschule Zürich, Switzerland || [[BLAKE]], [[EnRUPT]]
|-
| <nowiki>Shoichi Hirose</nowiki> || University of Fukui, Japan || [[Lesamnta]]
|-
| <nowiki>Seokhie Hong</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Thomas Icart</nowiki> || Sagem Sécurité || [[Shabal]]
|-
| <nowiki>Sebastiaan Indesteege</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Mickael Ivascot</nowiki> || ? || [[CRUNCH]]
|-
| <nowiki>Tetsu Iwata</nowiki> || Nagoya University, Japan || [[AURORA]]
|-
| <nowiki>William Jalby</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Robert J. Jenkins Jr.</nowiki> || Private individual || [[Maraca]]
|-
| <nowiki>Charanjit S. Jutla</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Changheon Kang</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Jinkeon Kang</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Orhun Kara</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Ferhat Karakoc</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Emilia Käsper</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Asif Khan</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Dmitry Khovratovich</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Jongsung Kim</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Vlastimil Klima</nowiki> || Independent cryptologist - consultant, Czech Republic || [[Blue Midnight Wish]]
|-
| <nowiki>Svein Johan Knapskog</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Lars R. Knudsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Çetin Kaya Koç</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Çelebi Kocair</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Ljupco Kocarev</nowiki> || University of California San Diego, USA and Macedonian Academy of Sciences and Arts || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Tadayoshi Kohno</nowiki> || University of Washington, USA || [[Skein]]
|-
| <nowiki>Michael Kounavis</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Jayant Krishnamurthy</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Hidenori Kuwakado</nowiki> || Kobe University, Japan || [[Lesamnta]]
|-
| <nowiki>Özgül Kücük</nowiki> || Katholieke Universiteit Leuven, Belgium || [[Hamsi]]
|-
| <nowiki>Changhoon Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jason Lee</nowiki> || ? || [[HASH 2X]]
|-
| <nowiki>Jesang Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jongtae Lee</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Sangjin Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Yuseop Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jongin Lim</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Gaëtan Leurent</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Yuncheng Lin</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Stefan Lucks</nowiki> || Bauhaus-Universität Weimar, Germany || [[Skein]]
|-
| <nowiki>Olivier Ly</nowiki> || Université Bordeaux, France || [[CRUNCH]]
|-
| <nowiki>Vadim Lyubashevsky</nowiki> || Tel-Aviv University, Israel || [[SWIFFTX]]
|-
| <nowiki>Gilles Macario-Rat</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Megan Maguire</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Sean Malone</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Cevat Manap</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Stéphane Manuel</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Smile Markovski</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[NaSHA]]
|-
| <nowiki>Jason Worth Martin</nowiki> || James Madison University, USA || [[ESSENCE]]
|-
| <nowiki>Mikhail Maslennikov</nowiki> || NETS Corporation || [[MCSSHA-3]]
|-
| <nowiki>Krystian Matusiewicz</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Maxwell</nowiki> || Private individual || [[Sgàil]]
|-
| <nowiki>Cameron McDonald</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Gary McGuire</nowiki> || University College Dublin, Ireland || [[Tangle]]
|-
| <nowiki>Willi Meier</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Florian Mendel</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Daniele Micciancio</nowiki> || University of California at San Diego, USA || [[SWIFFTX]]
|-
| <nowiki>Marija Mihova</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Aleksandra Mileva</nowiki> || University Goce Delčev, Macedonia || [[NaSHA]]
|-
| <nowiki>Carl Minden</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jean-François Misarsky</nowiki> || France Telecom || [[Shabal]]
|-
| <nowiki>Stig Frode Mjølsnes</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Miguel Montes</nowiki> || Universidad Nacional de Córdoba, Argentina || [[TIB3]]
|-
| <nowiki>Shiho Moriai</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Valerie Nachef</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Marìa Naya-Plasencia</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Ivica Nikolić</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Svetla Nikova</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Karsten Nohl</nowiki> || University of Virginia, USA || [[EnRUPT]]
|-
| <nowiki>Rune Steinsmo Ødegård</nowiki> || Norwegian University of Science and Technology, Norway || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Sean O'Neil</nowiki> || VEST Corporation || [[EnRUPT]]
|-
| <nowiki>Hilarie Orman</nowiki> || Purple Streak, USA|| [[SANDstorm]]
|-
| <nowiki>Onur Özen</nowiki> || Ecole Polytechnique Fédérale de Lausanne, Switzerland || [[Sarmal]]
|-
| <nowiki>Pascal Paillier</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Geoffrey Park</nowiki> || ? || [[NKS2D]]
|-
| <nowiki>Jacques Patarin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Michaël Peeters</nowiki> || NXP Semiconductors || [[Keccak]]
|-
| <nowiki>Chris Peikert</nowiki> || SRI International || [[SWIFFTX]]
|-
| <nowiki>Daniel Penazzi</nowiki> || Universidad Nacional de Córdoba, Argentina || [[TIB3]]
|-
| <nowiki>Thomas Peyrin</nowiki> || Orange Labs/Ingenico || [[ECHO]]
|-
| <nowiki>Raphael C.-W. Phan</nowiki> || Loughborough University, UK || [[BLAKE]]
|-
| <nowiki>Thomas Pornin</nowiki> || Cryptolog International || [[Shabal]]
|-
| <nowiki>Bart Preneel</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Christian Rechberger</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Jean-René Reinhard</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Leo Reyzin</nowiki> || Boston University, USA || [[MD6]]
|-
| <nowiki>Ron Rivest</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Matt Robshaw</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Greg Rose</nowiki> || QUALCOMM Inc. || [[Boole]]
|-
| <nowiki>Alon Rosen</nowiki> || IDC Herzliya, Israel || [[SWIFFTX]]
|-
| <nowiki>Gokay Saldamlı</nowiki> || Oregon State University, USA || [[Spectral Hash]]
|-
| <nowiki>Hisayoshi Sato</nowiki> || Hitachi || [[Luffa]]
|-
| <nowiki>Martin Schläffer</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Schmidt-Nielsen</nowiki> || ? || [[Ponic]]
|-
| <nowiki>Bruce Schneier</nowiki> || BT Group plc || [[Skein]]
|-
| <nowiki>Richard Schroeppel</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Nicolas Sendrier</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Yannick Seurin</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Emily Shen</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Kyoji Shibutani</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Taizo Shirai</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Neil Sholer</nowiki> || WaveStrong, Inc. || [[Abacus]]
|-
| <nowiki>René Struik</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Jim Sukha</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Jaechul Sung</nowiki> || University of Seoul, Korea || [[ARIRANG]]
|-
| <nowiki>Drew Sutherland</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Søren S. Thomsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Céline Thuillet</nowiki> || EADS Secure Networks || [[Shabal]]
|-
| <nowiki>Elmar Tischhauer</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Jacob Topper</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Mark Torgerson</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Joana Treger</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Alex Troesch</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Michal Trojnara</nowiki> || ? || [[StreamHash]]
|-
| <nowiki>Eran Tromer</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Gilles Van Assche</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Kerem Varıcı</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Marion Videau</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Natarajan Vijayarangan</nowiki> || Tata Consultancy Services || [[Khichidi-1]]
|-
| <nowiki>Emmanuel Volte</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Andrea Walker</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Cody Walker</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jesse Walker</nowiki> || Intel Corporation || [[Skein]]
|-
| <nowiki>John Washburn</nowiki> || Washburn Research || [[WaMM]]
|-
| <nowiki>Dai Watanabe</nowiki> || Hitachi || [[Luffa]]
|-
| <nowiki>Doug Whiting</nowiki> || Hifn, Inc. || [[Skein]]
|-
| <nowiki>David A. Wilson</nowiki> || Massachusetts Institute of Technology, USA || [[DCH]]
|-
| <nowiki>Hongjun Wu</nowiki> || Institute for Infocomm Research, Singapore || [[JH]]
|-
| <nowiki>Zijie Xu</nowiki> || ? || [[Dynamic SHA]], [[Dynamic SHA2]]
|-
| <nowiki>Yiqun Lisa Yin</nowiki> || Independent cryptography and security consultant || [[MD6]]
|-
| <nowiki>Hirotaka Yoshida</nowiki> || Hitachi || [[Lesamnta]]
|-
| <nowiki>Antonio Zamora</nowiki> || University of Alicante, Spain || [[Tangle]]
|}

SHA-3 submitters

2008-12-11T14:38:38Z

SThomsen: Added many new submitters

Below, all known SHA-3 candidate submitters are listed with affiliation and candidate algorithm. In many cases, the affiliations were found using [http://www.google.com Google], and hence may be outdated or otherwise erroneous. If you find errors, drop a line at sha3zoo@iaik.tugraz.at to let us know.

[[The_SHA-3_Zoo|Click here]] to go back to the SHA-3 Zoo main page.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="180"| Submitter name !! width="400"| Affiliation !! width="180"| Algorithm(s)
|-
| <nowiki>Benjamin Agre</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Toru Akishita</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Rafael Alvarez</nowiki> || University of Alicante, Spain || [[Tangle]]
|-
| <nowiki>Jørn Amundsen</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Elena Andreeva</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Adrian Antipa</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Yuriy Arbitman</nowiki> || ? || [[SWIFFTX]]
|-
| <nowiki>Adem Atalay</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Daniel Augot</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Jean-Philippe Aumasson</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Daniel V. Bailey</nowiki> || RSA Laboratories || [[MD6]]
|-
| <nowiki>Mihir Bellare</nowiki> || University of California San Diego, USA || [[Skein]]
|-
| <nowiki>Ryad Benadjila</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Dan Bernstein</nowiki> || University of Illinois at Chicago, USA || [[CubeHash]]
|-
| <nowiki>Guido Bertoni</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Eli Biham</nowiki> || Technion, Israel || [[SHAvite-3]]
|-
| <nowiki>Olivier Billet</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Alex Biryukov</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Charles Bouillaguet</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Colin Bradbury</nowiki> || ? || [[Blender]]
|-
| <nowiki>Emmanuel Bresson</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Daniel R. L. Brown</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Jon Callas</nowiki> || PGP Corporation || [[Skein]]
|-
| <nowiki>Matt Campagna</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Anne Canteaut</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Donghoon Chang</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Benoît Chevallier-Mames</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Christophe Clavier</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Michael Collins</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Christopher Crutchfield</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Joan Daemen</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Nathan Dautenhahn</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Christophe De Cannière</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]], [[Luffa]]
|-
| <nowiki>Cevahir Demirkıran</nowiki> || Universitat Autònoma de Barcelona, Spain || [[Spectral Hash]]
|-
| <nowiki>Yevgeniy Dodis</nowiki> || New York University, USA || [[MD6]]
|-
| <nowiki>Gil Dogon</nowiki> || Mobileye Inc., Israel || [[SWIFFTX]]
|-
| <nowiki>Tim Draelos</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Aleš Drápal</nowiki> || Charles University, Czech Republic || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Orr Dunkelman</nowiki> || École Normale Supérieure (Ulm), France || [[LANE]], [[SHAvite-3]]
|-
| <nowiki>Mohamed El-Hadedy</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Björn Fay</nowiki> || Justus Liebig-Universität, Germany || [[MeshHash]]
|-
| <nowiki>Niels Ferguson</nowiki> || Microsoft Corporation || [[Skein]]
|-
| <nowiki>Matthieu Finiasz</nowiki> || École Nationale Supérieure de Techniques Avancées, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Ewan Fleischmann</nowiki> || Bauhaus-University Weimar, Germany || [[Twister]]
|-
| <nowiki>Kermin Elliott Fleming</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Christian Forler</nowiki> || Sirrix AG || [[Twister]]
|-
| <nowiki>Pierre-Alain Fouque</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Thomas Fuhr</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Philippe Gaborit</nowiki> || Université de Limoges, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Praveen Gauravaram</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Henri Gilbert</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Danilo Gligoroski</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Michael Gorski</nowiki> || Bauhaus-University Weimar, Germany || [[Twister]]
|-
| <nowiki>Louis Goubin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Aline Gouget</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Shay Gueron</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Shai Halevi</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>William E. Hall</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Bob Hattersley</nowiki> || Opta Consulting || [[Waterfall]]
|-
| <nowiki>Phil Hawkes</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Luca Henzen</nowiki> || Eidgenössische Technische Hochschule Zürich, Switzerland || [[BLAKE]], [[EnRUPT]]
|-
| <nowiki>Shoichi Hirose</nowiki> || University of Fukui, Japan || [[Lesamnta]]
|-
| <nowiki>Seokhie Hong</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Thomas Icart</nowiki> || Sagem Sécurité || [[Shabal]]
|-
| <nowiki>Sebastiaan Indesteege</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Mickael Ivascot</nowiki> || ? || [[CRUNCH]]
|-
| <nowiki>Tetsu Iwata</nowiki> || Nagoya University, Japan || [[AURORA]]
|-
| <nowiki>William Jalby</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Robert J. Jenkins Jr.</nowiki> || Private individual || [[Maraca]]
|-
| <nowiki>Charanjit S. Jutla</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Changheon Kang</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Jinkeon Kang</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Orhun Kara</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Ferhat Karakoc</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Emilia Käsper</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Asif Khan</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Dmitry Khovratovich</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Jongsung Kim</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Vlastimil Klima</nowiki> || Independent cryptologist - consultant, Czech Republic || [[Blue Midnight Wish]]
|-
| <nowiki>Svein Johan Knapskog</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Lars R. Knudsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Çetin Kaya Koç</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Çelebi Kocair</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Ljupco Kocarev</nowiki> || University of California San Diego, USA and Macedonian Academy of Sciences and Arts || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Tadayoshi Kohno</nowiki> || University of Washington, USA || [[Skein]]
|-
| <nowiki>Michael Kounavis</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Jayant Krishnamurthy</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Hidenori Kuwakado</nowiki> || Kobe University, Japan || [[Lesamnta]]
|-
| <nowiki>Özgül Kücük</nowiki> || Katholieke Universiteit Leuven, Belgium || [[Hamsi]]
|-
| <nowiki>Changhoon Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jason Lee</nowiki> || ? || [[HASH 2X]]
|-
| <nowiki>Jesang Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jongtae Lee</nowiki> || ? || [[ARIRANG]]
|-
| <nowiki>Sangjin Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Yuseop Lee</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Jongin Lim</nowiki> || CIST, Korea University, Korea || [[ARIRANG]]
|-
| <nowiki>Gaëtan Leurent</nowiki> || École Normale Supérieure (Ulm), France || [[SIMD]]
|-
| <nowiki>Yuncheng Lin</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Stefan Lucks</nowiki> || Bauhaus-Universität Weimar, Germany || [[Skein]]
|-
| <nowiki>Olivier Ly</nowiki> || Université Bordeaux, France || [[CRUNCH]]
|-
| <nowiki>Vadim Lyubashevsky</nowiki> || Tel-Aviv University, Israel || [[SWIFFTX]]
|-
| <nowiki>Gilles Macario-Rat</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Megan Maguire</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Sean Malone</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Cevat Manap</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Stéphane Manuel</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Smile Markovski</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[NaSHA]]
|-
| <nowiki>Jason Worth Martin</nowiki> || James Madison University, USA || [[ESSENCE]]
|-
| <nowiki>Mikhail Maslennikov</nowiki> || NETS Corporation || [[MCSSHA-3]]
|-
| <nowiki>Krystian Matusiewicz</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Maxwell</nowiki> || Private individual || [[Sgàil]]
|-
| <nowiki>Cameron McDonald</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Gary McGuire</nowiki> || University College Dublin, Ireland || [[Tangle]]
|-
| <nowiki>Willi Meier</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Florian Mendel</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Daniele Micciancio</nowiki> || University of California at San Diego, USA || [[SWIFFTX]]
|-
| <nowiki>Marija Mihova</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Aleksandra Mileva</nowiki> || University Goce Delčev, Macedonia || [[NaSHA]]
|-
| <nowiki>Carl Minden</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jean-François Misarsky</nowiki> || France Telecom || [[Shabal]]
|-
| <nowiki>Stig Frode Mjølsnes</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Miguel Montes</nowiki> || Universidad Nacional de Córdoba, Argentina || [[TIB3]]
|-
| <nowiki>Shiho Moriai</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Valerie Nachef</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Marìa Naya-Plasencia</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Ivica Nikolić</nowiki> || University of Luxembourg, Luxembourg || [[Cheetah]], [[LUX]]
|-
| <nowiki>Svetla Nikova</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Karsten Nohl</nowiki> || University of Virginia, USA || [[EnRUPT]]
|-
| <nowiki>Rune Steinsmo Ødegård</nowiki> || Norwegian University of Science and Technology, Norway || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Sean O'Neil</nowiki> || VEST Corporation || [[EnRUPT]]
|-
| <nowiki>Hilarie Orman</nowiki> || Purple Streak, USA|| [[SANDstorm]]
|-
| <nowiki>Onur Özen</nowiki> || Ecole Polytechnique Fédérale de Lausanne, Switzerland || [[Sarmal]]
|-
| <nowiki>Pascal Paillier</nowiki> || Gemalto || [[Shabal]]
|-
| <nowiki>Geoffrey Park</nowiki> || ? || [[NKS2D]]
|-
| <nowiki>Jacques Patarin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Michaël Peeters</nowiki> || NXP Semiconductors || [[Keccak]]
|-
| <nowiki>Chris Peikert</nowiki> || SRI International || [[SWIFFTX]]
|-
| <nowiki>Daniel Penazzi</nowiki> || Universidad Nacional de Córdoba, Argentina || [[TIB3]]
|-
| <nowiki>Thomas Peyrin</nowiki> || Orange Labs/Ingenico || [[ECHO]]
|-
| <nowiki>Raphael C.-W. Phan</nowiki> || Loughborough University, UK || [[BLAKE]]
|-
| <nowiki>Thomas Pornin</nowiki> || Cryptolog International || [[Shabal]]
|-
| <nowiki>Bart Preneel</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Christian Rechberger</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Jean-René Reinhard</nowiki> || DCSSI Crypto Lab, France || [[Shabal]]
|-
| <nowiki>Leo Reyzin</nowiki> || Boston University, USA || [[MD6]]
|-
| <nowiki>Ron Rivest</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Matt Robshaw</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Greg Rose</nowiki> || QUALCOMM Inc. || [[Boole]]
|-
| <nowiki>Alon Rosen</nowiki> || IDC Herzliya, Israel || [[SWIFFTX]]
|-
| <nowiki>Gokay Saldamlı</nowiki> || Oregon State University, USA || [[Spectral Hash]]
|-
| <nowiki>Hisayoshi Sato</nowiki> || Hitachi || [[Luffa]]
|-
| <nowiki>Martin Schläffer</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Schmidt-Nielsen</nowiki> || ? || [[Ponic]]
|-
| <nowiki>Bruce Schneier</nowiki> || BT Group plc || [[Skein]]
|-
| <nowiki>Richard Schroeppel</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Nicolas Sendrier</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Yannick Seurin</nowiki> || Orange Labs || [[ECHO]]
|-
| <nowiki>Emily Shen</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Kyoji Shibutani</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Taizo Shirai</nowiki> || Sony Corp. || [[AURORA]]
|-
| <nowiki>Neil Sholer</nowiki> || WaveStrong, Inc. || [[Abacus]]
|-
| <nowiki>René Struik</nowiki> || Certicom || [[ECOH]]
|-
| <nowiki>Jim Sukha</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Jaechul Sung</nowiki> || University of Seoul, Korea || [[ARIRANG]]
|-
| <nowiki>Drew Sutherland</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Søren S. Thomsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Céline Thuillet</nowiki> || EADS Secure Networks || [[Shabal]]
|-
| <nowiki>Elmar Tischhauer</nowiki> || Katholieke Universiteit Leuven, Belgium || [[LANE]]
|-
| <nowiki>Jacob Topper</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Mark Torgerson</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Joana Treger</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Alex Troesch</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Michal Trojnara</nowiki> || ? || [[StreamHash]]
|-
| <nowiki>Eran Tromer</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Gilles Van Assche</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Kerem Varıcı</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Marion Videau</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[Shabal]]
|-
| <nowiki>Natarajan Vijayarangan</nowiki> || Tata Consultancy Services || [[Khichidi-1]]
|-
| <nowiki>Emmanuel Volte</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Andrea Walker</nowiki> || Sandia National Laboratories, USA|| [[SANDstorm]]
|-
| <nowiki>Cody Walker</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jesse Walker</nowiki> || Intel Corporation || [[Skein]]
|-
| <nowiki>John Washburn</nowiki> || Washburn Research || [[WaMM]]
|-
| <nowiki>Dai Watanabe</nowiki> || Hitachi || [[Luffa]]
|-
| <nowiki>Doug Whiting</nowiki> || Hifn, Inc. || [[Skein]]
|-
| <nowiki>David A. Wilson</nowiki> || Massachusetts Institute of Technology, USA || [[DCH]]
|-
| <nowiki>Hongjun Wu</nowiki> || Institute for Infocomm Research, Singapore || [[JH]]
|-
| <nowiki>Zijie Xu</nowiki> || ? || [[Dynamic SHA]], [[Dynamic SHA2]]
|-
| <nowiki>Yiqun Lisa Yin</nowiki> || Independent cryptography and security consultant || [[MD6]]
|-
| <nowiki>Hirotaka Yoshida</nowiki> || Hitachi || [[Lesamnta]]
|-
| <nowiki>Antonio Zamora</nowiki> || University of Alicante, Spain || [[Tangle]]
|}

The SHA-3 Zoo

2008-12-11T12:41:38Z

SThomsen:

The SHA-3 Zoo is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (work in progress). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates. Another categorization of the SHA-3 submissions can be found [http://www.uni-weimar.de/cms/fileadmin/medien/medsicherheit/Research/SHA3/Classification_of_the_SHA-3_Candidates.pdf here].
 
At this time, 55 out of 64 submissions to the SHA-3 competition are publicly known and available, and hence take advantage of early external cryptanalysis. [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html 51] submissions have advanced to first round (so far, 9 submissions have been broken).

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="150"| Hash Function Name !! width="150"| Status !! width="150"| [[External Cryptanalysis Categories| External Cryptanalysis]]
|-
| [[Abacus]] || 1st round || none
|-
| [[ARIRANG]] || 1st round || none
|-
| [[AURORA]] || 1st round || none
|-
| [[BLAKE]] || 1st round || none
|-
| [[Blender]] || 1st round || none
|-
| [[Blue Midnight Wish]] || 1st round || yes
|-
| [[Boole]] || 1st round || broken
|-
| [[Cheetah]] || 1st round || none
|-
| [[CHI]] || 1st round || none
|-
| [[CRUNCH]] || 1st round || none
|-
| [[CubeHash]] || 1st round || yes
|-
| [[DCH]] || 1st round || broken
|-
| [[Dynamic SHA]] || 1st round || none
|-
| [[Dynamic SHA2]] || 1st round || none
|-
| [[ECHO]] || 1st round || none
|-
| [[ECOH]] || 1st round || none
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || 1st round || yes
|-
| [[EnRUPT]] || 1st round || broken
|-
| [[ESSENCE]] || 1st round || none
|-
| [[FSB (SHA-3 submission) | FSB]] || 1st round || none
|-
| [[Fugue]] || 1st round || none
|-
| [[Groestl|Grøstl]] || 1st round || yes
|-
| [[Hamsi]] || 1st round || none
|-
| [[HASH 2X]] || submitted || broken
|-
| [[JH]] || 1st round || yes
|-
| [[Keccak]] || 1st round || none
|-
| [[Khichidi-1]] || 1st round || none
|-
| [[LANE]] || 1st round || none
|-
| [[Lesamnta]] || 1st round || none
|-
| [[Luffa]] || 1st round || none
|-
| [[LUX]] || 1st round || none
|-
| [[Maraca]] || submitted || none
|-
| [[MCSSHA-3]] || 1st round || broken
|-
| [[MD6]] || 1st round || yes
|-
| [[MeshHash]] || 1st round || yes
|-
| [[NaSHA]] || 1st round || yes
|-
| [[NKS2D]] || submitted || broken
|-
| [[Ponic]] || submitted || broken
|-
| [[SANDstorm]] || 1st round || none
|-
| [[Sarmal]] || 1st round || yes
|-
| [[Sgàil]] || 1st round || broken
|-
| [[Shabal]] || 1st round || none
|-
| [[SHAMATA]] || 1st round || yes
|-
| [[SHAvite-3]] || 1st round || none
|-
| [[SIMD]] || 1st round || none
|-
| [[Skein]] || 1st round || none
|-
| [[Spectral Hash]] || 1st round || yes
|-
| [[StreamHash]] || 1st round || yes
|-
| [[SWIFFTX]] || 1st round || none
|-
| [[Tangle]] || 1st round || none
|-
| [[TIB3]] || 1st round || none
|-
| [[Twister]] || 1st round || none
|-
| [[Vortex (SHA-3 submission)|Vortex]] || 1st round || yes
|-
| [[WaMM]] || 1st round || broken
|-
| [[Waterfall]] || 1st round || none
|}

Your submission is not on this list? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

The SHA-3 Zoo

2008-12-01T15:44:38Z

SThomsen:

The SHA-3 Zoo is a collection of cryptographic hash functions (in alphabetical order) submitted to the [http://www.nist.gov/hash-competition SHA-3 contest] (work in progress). It aims to provide an overview of design and cryptanalysis of all submissions. A list of all [[SHA-3 submitters]] is also available. For a software performance related overview, see [http://bench.cr.yp.to/ebash.html eBASH]. At a separate page, we also collect [[SHA-3_Hardware_Implementations | hardware implementation results]] of the candidates.
 
At this time, 34 out of 64 submissions to the SHA-3 competition are publicly known and available, and hence take advantage of early external cryptanalysis (so far, 9 submissions have been broken).

[http://ehash.iaik.tugraz.at/index.php?title=Special:Recentchangeslinked&target=The_SHA-3_Zoo&days=7&limit=50&hideminor=1 Recent updates of the SHA-3 Zoo]

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="150"| Hash Function Name !! width="150"| Status !! width="150"| [[External Cryptanalysis Categories| External Cryptanalysis]]
|-
| [[BLAKE]] || submitted || none
|-
| [[Blue Midnight Wish]] || submitted || yes
|-
| [[Boole]] || submitted || broken
|-
| [[CHI]] || submitted || none
|-
| [[CRUNCH]] || submitted || none
|-
| [[CubeHash]] || submitted || yes
|-
| [[DCH]] || submitted || broken
|-
| [[Edon-R (SHA-3 submission)|Edon-R]] || submitted || yes
|-
| [[EnRUPT]] || submitted || broken
|-
| [[ESSENCE]] || submitted || none
|-
| [[FSB (SHA-3 submission) | FSB]] || submitted || none
|-
| [[Fugue]] || submitted || none
|-
| [[Groestl|Grøstl]] || submitted || yes
|-
| [[HASH 2X]] || submitted || broken
|-
| [[JH]] || submitted || none
|-
| [[Keccak]] || submitted || none
|-
| [[LANE]] || submitted || none
|-
| [[Maraca]] || submitted || none
|-
| [[MCSSHA-3]] || submitted || broken
|-
| [[MD6]] || submitted || yes
|-
| [[MeshHash]] || submitted || yes
|-
| [[NaSHA]] || submitted || none
|-
| [[NKS2D]] || submitted || broken
|-
| [[Ponic]] || submitted || broken
|-
| [[Sarmal]] || submitted || yes
|-
| [[Sgàil]] || submitted || broken
|-
| [[SHAMATA]] || submitted || yes
|-
| [[Skein]] || submitted || none
|-
| [[Spectral Hash]] || submitted || yes
|-
| [[SWIFFTX]] || submitted || none
|-
| [[TIB3]] || submitted || none
|-
| [[Vortex (SHA-3 submission)|Vortex]] || submitted || yes
|-
| [[WaMM]] || submitted || broken
|-
| [[Waterfall]] || submitted || none
|}

Your submission is not on this list? Drop a line at sha3zoo@iaik.tugraz.at to let us know!

MeshHash

2008-12-01T15:42:10Z

SThomsen: Second preimage attack on MeshHash

== The algorithm ==

* Author(s): Björn Fay
* Website: [http://bfay.de/download/meshhash.7z http://bfay.de/download/meshhash.7z]
* Specification:

<bibtex>
@misc{sha3Fay08,
author = {Björn Fay},
title = {MeshHash},
url = {http://ehash.iaik.tugraz.at/uploads/5/5a/Specification_DIN-A4.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

<bibtex>
@misc{Thomsen-meshhash-2ndpreim,
author = {Søren S. Thomsen},
title = {Second preimage attack on MeshHash},
howpublished = {Available online},
url = {http://www.mat.dtu.dk/people/S.Thomsen/meshhash/2ndpreimage.pdf},
year = {2008}
}
</bibtex>

Blue Midnight Wish

2008-11-27T10:04:41Z

SThomsen:

== The algorithm ==

* Author(s): Danilo Gligoroski, Vlastimil Klima, Svein Johan Knapskog, Mohamed El-Hadedy, Jørn Amundsen, Stig Frode Mjølsnes
* Website: [http://www.item.ntnu.no/people/personalpages/fac/danilog/blue_midnight_wish http://www.item.ntnu.no/people/personalpages/fac/danilog/blue_midnight_wish]
* Specification:

<bibtex>
@misc{sha3GKK+08,
author = {Danilo Gligoroski and Vlastimil Klima and Svein Johan Knapskog and Mohamed El-Hadedy and Jørn Amundsen and Stig Frode Mjølsnes},
title = {Cryptographic Hash Function BLUE MIDNIGHT WISH},
url = {http://people.item.ntnu.no/~danilog/Hash/BMW/Supporting_Documentation/BlueMidnightWishDocumentation.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

<bibtex>
@misc{Thomsen-bmw-nc-compress,
author = {Søren S. Thomsen},
title = {A near-collision attack on the Blue Midnight Wish compression function},
url = {http://www2.mat.dtu.dk/people/S.Thomsen/bmw/nc-compress.pdf},
howpublished = {Version 2.0, available online},
year = {2008},
}
</bibtex>

The SHA-3 Zoo

2008-11-26T22:16:57Z

SThomsen:

Blue Midnight Wish

2008-11-26T22:15:52Z

SThomsen:

SHA-3 submitters

2008-11-23T12:49:15Z

SThomsen:

SHA-3 submitters

2008-11-18T11:02:33Z

SThomsen:

Vortex (SHA-3 submission)

2008-11-18T11:00:04Z

SThomsen:

== The algorithm ==

* Author(s): Michael Kounavis, Shay Gueron
* Website:
* Specification: [http://eprint.iacr.org/2008/464 http://eprint.iacr.org/2008/464]

<bibtex>
@misc{sha3KounavisG08,
author = {Michael Kounavis and Shay Gueron},
title = {Vortex: A New Family of One Way Hash Functions based on Rijndael Rounds and Carry-less Multiplication},
url = {http://eprint.iacr.org/2008/464.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

Anonymous: Collision and Preimage Attacks on Vortex as submitted to the SHA-3 competition, [http://ehash.iaik.tugraz.at/uploads/5/5c/Vortex_Collisions_and_Preimages_note.txt Local link]

Spectral Hash

2008-11-18T10:59:39Z

SThomsen:

== The algorithm ==

* Author(s): Gokay Saldamlı, Cevahir Demirkıran, Megan Maguire, Carl Minden, Jacob Topper, Alex Troesch, Cody Walker, Çetin Kaya Koç

* Website: [http://www.cs.ucsb.edu/~koc/shash/index.html http://www.cs.ucsb.edu/~koc/shash/index.html]
* Specification:

<bibtex>
@misc{sha3Saldamli+08,
author = {Gokay Saldamlı, Cevahir Demirkıran, Megan Maguire, Carl Minden, Jacob Topper, Alex Troesch, Cody Walker, Çetin Kaya Koç},
title = {Spectral Hash},
url = {http://www.cs.ucsb.edu/~koc/shash/sHash.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

* None yet

Sarmal

2008-11-18T10:58:38Z

SThomsen:

== The algorithm ==

* Author(s): Kerem Varıcı, Onur Özen and Çelebi Kocair
* Website: [http://www.metu.edu.tr/~e127761/sarmal_hash.html http://www.metu.edu.tr/~e127761/sarmal_hash.html]
* Specification:

<bibtex>
@misc{sha3VariciOK08,
author = {Kerem Varıcı and Onur Özen and Çelebi Kocair},
title = {Sarmal: SHA-3 Proposal},
url = {http://www.metu.edu.tr/~e127761/Supporting_Documentation/SarmaL.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

* None yet

Keccak

2008-11-18T10:57:31Z

SThomsen:

== The algorithm ==

* Author(s): Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche
* Website: [http://keccak.noekeon.org/ http://keccak.noekeon.org/]
* Specification:

<bibtex>
@misc{KeccakSpecs,
author = {G. Bertoni and J. Daemen and M. Peeters and G. Van Assche},
title = {Keccak specifications},
url = {http://keccak.noekeon.org/Keccak-specifications.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

<bibtex>
@misc{KeccakMain,
author = {G. Bertoni and J. Daemen and M. Peeters and G. Van Assche},
title = {Keccak sponge function family main document},
url = {http://keccak.noekeon.org/Keccak-main-1.0.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

* None yet

CHI

2008-11-18T10:54:45Z

SThomsen:

== The algorithm ==

* Author(s): Phil Hawkes, Cameron McDonald
* Website:
* Specification: [http://ehash.iaik.tugraz.at/uploads/2/2c/Chi_submission.pdf local link]

<bibtex>
@misc{sha3HawkesM08,
author = {Phil Hawkes and Cameron McDonald},
title = {Submission to the SHA-3 Competition: The CHI Family of Cryptographic Hash Algorithms},
url = {http://ehash.iaik.tugraz.at/uploads/2/2c/Chi_submission.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

* None yet

CRUNCH

2008-11-18T10:53:34Z

SThomsen:

== The algorithm ==

* Author(s): Louis Goubin, Mickael Ivascot, William Jalby, Olivier Ly, Valerie Nachef, Jacques Patarin, Joana Treger, Emmanuel Volte
* Website: [http://www.voltee.com/crunch/ http://www.voltee.com/crunch/]
* Specification:

<bibtex>
@misc{sha3Patarin08,
author = {Louis Goubin and Mickael Ivascot and William Jalby and Olivier Ly and Valerie Nachef and Jacques Patarin and Joana Treger and Emmanuel Volte},
title = {CRUNCH},
url = {http://www.voltee.com/crunch/cdrom/Supporting_Documentation/crunch_specifications.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

* None yet

CRUNCH

2008-11-18T10:53:00Z

SThomsen:

== The algorithm ==

* Author(s): Louis Goubin, Mickael Ivascot, William Jalby, Olivier Ly, Valerie Nachef, Jacques Patarin, Joana Treger, Emmanuel Volte
* Website: [http://www.voltee.com/crunch/ http://www.voltee.com/crunch/]
* Specification:

<bibtex>
@misc{sha3Bernstein08,
author = {Louis Goubin and Mickael Ivascot and William Jalby and Olivier Ly and Valerie Nachef and Jacques Patarin and Joana Treger and Emmanuel Volte},
title = {CRUNCH},
url = {http://www.voltee.com/crunch/cdrom/Supporting_Documentation/crunch_specifications.pdf},
howpublished = {Submission to NIST},
year = {2008},
}
</bibtex>

== Cryptanalysis ==

* None yet

SHA-3 submitters

2008-11-18T10:48:43Z

SThomsen:

The SHA-3 Zoo

2008-11-18T10:43:41Z

SThomsen:

SHA-3 submitters

2008-11-14T15:19:50Z

SThomsen:

Below, all known SHA-3 candidate submitters are listed with affiliation and candidate algorithm. In many cases, the affiliations were found using Google, and hence may be erroneous. If you find errors, drop a line at sha3zoo@iaik.tugraz.at to let us know.

[[The_SHA-3_Zoo|Click here]] to go back to the SHA-3 Zoo main page.

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="180"| Submitter name !! width="400"| Affiliation !! width="180"| Algorithm
|-
| <nowiki>Benjamin Agre</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Jørn Amundsen</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Adem Atalay</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Daniel Augot</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Jean-Philippe Aumasson</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Daniel V. Bailey</nowiki> || RSA Laboratories || [[MD6]]
|-
| <nowiki>Mihir Bellare</nowiki> || University of California San Diego, USA || [[Skein]]
|-
| <nowiki>Dan Bernstein</nowiki> || University of Illinois at Chicago, USA || [[CubeHash]]
|-
| <nowiki>Guido Bertoni</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Jon Callas</nowiki> || PGP Corporation || [[Skein]]
|-
| <nowiki>Christopher Crutchfield</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Joan Daemen</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Cevahir Demirkıran</nowiki> || Universitat Autònoma de Barcelona, Spain || [[Spectral Hash]]
|-
| <nowiki>Yevgeniy Dodis</nowiki> || New York University, USA || [[MD6]]
|-
| <nowiki>Aleš Drápal</nowiki> || Charles University, Czech Republic || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Mohamed El-Hadedy</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Niels Ferguson</nowiki> || Microsoft Corporation || [[Skein]]
|-
| <nowiki>Matthieu Finiasz</nowiki> || École Nationale Supérieure de Techniques Avancées, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Kermin Elliott Fleming</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Philippe Gaborit</nowiki> || Université de Limoges, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Praveen Gauravaram</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Danilo Gligoroski</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Louis Goubin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Shay Gueron</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Shai Halevi</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>William E. Hall</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Bob Hattersley</nowiki> || Opta Consulting || [[Waterfall]]
|-
| <nowiki>Phil Hawkes</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Luca Henzen</nowiki> || Eidgenössische Technische Hochschule Zürich, Switzerland || [[BLAKE]], [[EnRUPT]]
|-
| <nowiki>Mickael Ivascot</nowiki> || ? || [[CRUNCH]]
|-
| <nowiki>William Jalby</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Robert J. Jenkins Jr.</nowiki> || Private individual || [[Maraca]]
|-
| <nowiki>Charanjit S. Jutla</nowiki> || IBM T.J. Watson Research Center || [[Fugue]]
|-
| <nowiki>Orhun Kara</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Ferhat Karakoc</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Asif Khan</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Vlastimil Klima</nowiki> || Independent cryptologist - consultant, Czech Republic || [[Blue Midnight Wish]]
|-
| <nowiki>Svein Johan Knapskog</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Lars R. Knudsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Çetin Kaya Koç</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Çelebi Kocair</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Ljupco Kocarev</nowiki> || University of California San Diego, USA and Macedonian Academy of Sciences and Arts || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Tadayoshi Kohno</nowiki> || University of Washington, USA || [[Skein]]
|-
| <nowiki>Michael Kounavis</nowiki> || Intel Corporation || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Jayant Krishnamurthy</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Jason Lee</nowiki> || ? || [[HASH 2X]]
|-
| <nowiki>Yuncheng Lin</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Stefan Lucks</nowiki> || Bauhaus-Universität Weimar, Germany || [[Skein]]
|-
| <nowiki>Olivier Ly</nowiki> || Université Bordeaux, France || [[CRUNCH]]
|-
| <nowiki>Megan Maguire</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Cevat Manap</nowiki> || The National Research Institute of Electronics and Cryptology (UEKAE), Turkey || [[SHAMATA]]
|-
| <nowiki>Stéphane Manuel</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Smile Markovski</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[NaSHA]]
|-
| <nowiki>Jason Worth Martin</nowiki> || James Madison University, USA || [[ESSENCE]]
|-
| <nowiki>Mikhail Maslennikov</nowiki> || NETS Corporation || [[MCSSHA-3]]
|-
| <nowiki>Krystian Matusiewicz</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Maxwell</nowiki> || Private individual || [[Sgàil]]
|-
| <nowiki>Cameron McDonald</nowiki> || QUALCOMM Inc. || [[CHI]]
|-
| <nowiki>Willi Meier</nowiki> || Fachhochschule Nordwestschweiz, Switzerland || [[BLAKE]]
|-
| <nowiki>Florian Mendel</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Marija Mihova</nowiki> || Ss. Cyril and Methodius University, Macedonia || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Aleksandra Mileva</nowiki> || University Goce Delčev, Macedonia || [[NaSHA]]
|-
| <nowiki>Carl Minden</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Stig Frode Mjølsnes</nowiki> || Norwegian University of Science and Technology, Norway || [[Blue Midnight Wish]]
|-
| <nowiki>Valerie Nachef</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Karsten Nohl</nowiki> || University of Virginia, USA || [[EnRUPT]]
|-
| <nowiki>Rune Steinsmo Ødegård</nowiki> || Norwegian University of Science and Technology, Norway || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Sean O'Neil</nowiki> || VEST Corporation, France || [[EnRUPT]]
|-
| <nowiki>Onur Özen</nowiki> || Ecole Polytechnique Fédérale de Lausanne, Switzerland || [[Sarmal]]
|-
| <nowiki>Geoffrey Park</nowiki> || ? || [[NKS2D]]
|-
| <nowiki>Jacques Patarin</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Michaël Peeters</nowiki> || NXP Semiconductors || [[Keccak]]
|-
| <nowiki>Raphael C.-W. Phan</nowiki> || Loughborough University, UK || [[BLAKE]]
|-
| <nowiki>Christian Rechberger</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Leo Reyzin</nowiki> || Boston University, USA || [[MD6]]
|-
| <nowiki>Ron Rivest</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Greg Rose</nowiki> || QUALCOMM Inc. || [[Boole]]
|-
| <nowiki>Gokay Saldamlı</nowiki> || Oregon State University, USA || [[Spectral Hash]]
|-
| <nowiki>Martin Schläffer</nowiki> || Technische Universität Graz, Austria || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Schmidt-Nielsen</nowiki> || ? || [[Ponic]]
|-
| <nowiki>Bruce Schneier</nowiki> || BT Group plc || [[Skein]]
|-
| <nowiki>Nicolas Sendrier</nowiki> || Research Centre INRIA Paris-Rocquencourt, France || [[FSB (SHA-3 submission)|FSB]]
|-
| <nowiki>Emily Shen</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Jim Sukha</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Drew Sutherland</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Søren S. Thomsen</nowiki> || Technical University of Denmark || [[Groestl|Grøstl]]
|-
| <nowiki>Jacob Topper</nowiki> || University of California Santa Barbara, USA || [[Spectral Hash]]
|-
| <nowiki>Joana Treger</nowiki> || Université de Versailles, France || [[CRUNCH]]
|-
| <nowiki>Alex Troesch</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Eran Tromer</nowiki> || Massachusetts Institute of Technology, USA || [[MD6]]
|-
| <nowiki>Gilles Van Assche</nowiki> || STMicroelectronics || [[Keccak]]
|-
| <nowiki>Kerem Varıcı</nowiki> || Middle East Technical University, Turkey || [[Sarmal]]
|-
| <nowiki>Emmanuel Volte</nowiki> || Université de Cergy-Pontoise, France || [[CRUNCH]]
|-
| <nowiki>Cody Walker</nowiki> || ? || [[Spectral Hash]]
|-
| <nowiki>Jesse Walker</nowiki> || Intel Corporation || [[Skein]]
|-
| <nowiki>John Washburn</nowiki> || Washburn Research || [[WaMM]]
|-
| <nowiki>Doug Whiting</nowiki> || Hifn, Inc. || [[Skein]]
|-
| <nowiki>Yiqun Lisa Yin</nowiki> || Independent cryptography and security consultant || [[MD6]]
|}

SHA-3 submitters

2008-11-14T12:58:25Z

SThomsen:

{| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable"
|- style="background:#efefef;"
! width="250"| Submitter name !! width="200"| Algorithm(s)
|-
| <nowiki>Benjamin Agre</nowiki> || [[MD6]]
|-
| <nowiki>Jørn Amundsen</nowiki> || [[Blue Midnight Wish]]
|-
| <nowiki>Adem Atalay</nowiki> || [[SHAMATA]]
|-
| <nowiki>Daniel Augot</nowiki> || [[FSB (SHA-3 submission) | FSB]]
|-
| <nowiki>Jean-Philippe Aumasson</nowiki> || [[BLAKE]]
|-
| <nowiki>Daniel V. Bailey</nowiki> || [[MD6]]
|-
| <nowiki>Mihir Bellare</nowiki> || [[Skein]]
|-
| <nowiki>Dan Bernstein</nowiki> || [[CubeHash]]
|-
| <nowiki>Guido Bertoni</nowiki> || [[Keccak]]
|-
| <nowiki>Jon Callas</nowiki> || [[Skein]]
|-
| <nowiki>Christopher Crutchfield</nowiki> || [[MD6]]
|-
| <nowiki>Joan Daemen</nowiki> || [[Keccak]]
|-
| <nowiki>Cevahir Demirkıran</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Yevgeniy Dodis</nowiki> || [[MD6]]
|-
| <nowiki>Aleš Drápal</nowiki> || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Mohamed El-Hadedy</nowiki> || [[Blue Midnight Wish]]
|-
| <nowiki>Niels Ferguson</nowiki> || [[Skein]]
|-
| <nowiki>Matthieu Finiasz</nowiki> || [[FSB (SHA-3 submission) | FSB]]
|-
| <nowiki>Kermin Elliott Fleming</nowiki> || [[MD6]]
|-
| <nowiki>Philippe Gaborit</nowiki> || [[FSB (SHA-3 submission) | FSB]]
|-
| <nowiki>Praveen Gauravaram</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Danilo Gligoroski</nowiki> || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Louis Goubin</nowiki> || [[CRUNCH]]
|-
| <nowiki>Shay Gueron</nowiki> || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Shai Halevi</nowiki> || [[Fugue]]
|-
| <nowiki>William E. Hall</nowiki> || [[Fugue]]
|-
| <nowiki>Bob Hattersley</nowiki> || [[Waterfall]]
|-
| <nowiki>Phil Hawkes</nowiki> || [[CHI]]
|-
| <nowiki>Luca Henzen</nowiki> || [[BLAKE]], [[EnRUPT]]
|-
| <nowiki>Mickael Ivascot</nowiki> || [[CRUNCH]]
|-
| <nowiki>William Jalby</nowiki> || [[CRUNCH]]
|-
| <nowiki>Robert J. Jenkins Jr.</nowiki> || [[Maraca]]
|-
| <nowiki>Charanjit S. Jutla</nowiki> || [[Fugue]]
|-
| <nowiki>Orhun Kara</nowiki> || [[SHAMATA]]
|-
| <nowiki>Ferhat Karakoc</nowiki> || [[SHAMATA]]
|-
| <nowiki>Asif Khan</nowiki> || [[MD6]]
|-
| <nowiki>Vlastimil Klima</nowiki> || [[Blue Midnight Wish]]
|-
| <nowiki>Svein Johan Knapskog</nowiki> || [[Blue Midnight Wish]], [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Lars R. Knudsen</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Çetin Kaya Koç</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Çelebi Kocair</nowiki> || [[Sarmal]]
|-
| <nowiki>Ljupco Kocarev</nowiki> || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Tadayoshi Kohno</nowiki> || [[Skein]]
|-
| <nowiki>Michael Kounavis</nowiki> || [[Vortex (SHA-3 submission)|Vortex]]
|-
| <nowiki>Jayant Krishnamurthy</nowiki> || [[MD6]]
|-
| <nowiki>Jason Lee</nowiki> || [[HASH 2X]]
|-
| <nowiki>Yuncheng Lin</nowiki> || [[MD6]]
|-
| <nowiki>Stefan Lucks</nowiki> || [[Skein]]
|-
| <nowiki>Olivier Ly</nowiki> || [[CRUNCH]]
|-
| <nowiki>Megan Maguire</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Cevat Manap</nowiki> || [[SHAMATA]]
|-
| <nowiki>Stéphane Manuel</nowiki> || [[FSB (SHA-3 submission) | FSB]]
|-
| <nowiki>Smile Markovski</nowiki> || [[NaSHA]]
|-
| <nowiki>Jason Worth Martin</nowiki> || [[ESSENCE]]
|-
| <nowiki>Mikhail Maslennikov</nowiki> || [[MCSSHA-3]]
|-
| <nowiki>Krystian Matusiewicz</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Maxwell</nowiki> || [[Sgàil]]
|-
| <nowiki>Cameron McDonald</nowiki> || [[CHI]]
|-
| <nowiki>Willi Meier</nowiki> || [[BLAKE]]
|-
| <nowiki>Florian Mendel</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Marija Mihova</nowiki> || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Aleksandra Mileva</nowiki> || [[NaSHA]]
|-
| <nowiki>Carl Minden</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Stig Frode Mjølsnes</nowiki> || [[Blue Midnight Wish]]
|-
| <nowiki>Valerie Nachef</nowiki> || [[CRUNCH]]
|-
| <nowiki>Karsten Nohl</nowiki> || [[EnRUPT]]
|-
| <nowiki>Rune Steinsmo Ødegård</nowiki> || [[Edon-R (SHA-3 submission)|Edon-R]]
|-
| <nowiki>Sean O'Neil</nowiki> || [[EnRUPT]]
|-
| <nowiki>Onur Özen</nowiki> || [[Sarmal]]
|-
| <nowiki>Geoffrey Park</nowiki> || [[NKS2D]]
|-
| <nowiki>Michaël Peeters</nowiki> || [[Keccak]]
|-
| <nowiki>Raphael C.-W. Phan</nowiki> || [[BLAKE]]
|-
| <nowiki>Christian Rechberger</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Leo Reyzin</nowiki> || [[MD6]]
|-
| <nowiki>Ron Rivest</nowiki> || [[MD6]]
|-
| <nowiki>Greg Rose</nowiki> || [[Boole]]
|-
| <nowiki>Gokay Saldamlı</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Martin Schläffer</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Peter Schmidt-Nielsen</nowiki> || [[Ponic]]
|-
| <nowiki>Bruce Schneier</nowiki> || [[Skein]]
|-
| <nowiki>Nicolas Sendrier</nowiki> || [[FSB (SHA-3 submission) | FSB]]
|-
| <nowiki>Emily Shen</nowiki> || [[MD6]]
|-
| <nowiki>Jim Sukha</nowiki> || [[MD6]]
|-
| <nowiki>Drew Sutherland</nowiki> || [[MD6]]
|-
| <nowiki>Søren S. Thomsen</nowiki> || [[Groestl|Grøstl]]
|-
| <nowiki>Jacob Topper</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Joana Treger</nowiki> || [[CRUNCH]]
|-
| <nowiki>Alex Troesch</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Eran Tromer</nowiki> || [[MD6]]
|-
| <nowiki>Gilles Van Assche</nowiki> || [[Keccak]]
|-
| <nowiki>Kerem Varıcı</nowiki> || [[Sarmal]]
|-
| <nowiki>Emmanuel Volte</nowiki> || [[CRUNCH]]
|-
| <nowiki>Cody Walker</nowiki> || [[Spectral Hash]]
|-
| <nowiki>Jesse Walker</nowiki> || [[Skein]]
|-
| <nowiki>John Washburn</nowiki> || [[WaMM]]
|-
| <nowiki>Doug Whiting</nowiki> || [[Skein]]
|-
| <nowiki>Yiqun Lisa Yin</nowiki> || [[MD6]]
|}