7

Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512?

"Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, unless the improvements are critical to their application, people stick with the tried and true SHA-512. At least for a while."

Source: http://www.theregister.co.uk/2012/09/25/sha_3_hash_contest/

Improve this question
6
  • At least higher security margin and no length extensions.
    – CodesInChaos
    Feb 9, 2013 at 20:25
  • "higher security margin" - And that means?
    – user16986
    Feb 9, 2013 at 20:28
  • that it's probably harder to break.
    – CodesInChaos
    Feb 9, 2013 at 20:34
  • with an emphasis on "probably" - no one actually knows which one is harder to break...
    – user16986
    Feb 9, 2013 at 21:19
  • @nealmcb's answer on the linked question details the reasons for Keccak very well.
    – Rory Alsop ♦
    Feb 9, 2013 at 21:53

1 Answer 1

Reset to default
4

Since SHA-512 has stood the test of time, the argument Schneier is making is essentially:

  • There is nothing wrong with SHA-512, it has not proven insecure (even though it looked like it may be 7 years ago)
  • All the new systems proposed as SHA-3 are at best only very slightly smaller or faster than SHA-512, and that speed up doesn't justify the risk of pushing out something new and relatively untested (wrt a decade or so of SHA-512)

New systems are a pretty big deal, since they often have implications for the next round of hardware, recommendations that inform audits and compliance testing, etc. - so there needs to be a pretty high bar to clear between major versions of a major standard.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .