Hacker News Reader

Comment by codazoda | Hacker News Reader

I'm not sure if SHA-3 has a design goal of being fast. My understanding is that, if your using it for encryption, for example password storage, you want it to be slow. This helps with brute force attacks, particularly if someone gets ahold of your database full of password hashes and can unleash as many calculations as they want. Because the SHA family has typically been fast, they are considered bad candidates for passwords. My quick Google foo doesn't turn up the goals of the competition, but I'm guessing being fast might be a negative.

View on HN

Remember, what you are talking about is only one application of hash functions. In the world of crypto, speed becomes very important in things like MACs and signatures. There are a ton of other uses for hash functions that are not crypto-related too!

Besides, even when using a "fast" hash function for password storage, you can always just increase the number of rounds to compensate.

SHA-3 is supposed to be fast.

Do not use SHA-3 for password storage!

Use a key-stretching password hash function e.g. bcrypt or scrypt.

(These take a fast hash or encryption function and apply it many many times, to make the total work be slow.)

You're technically wrong, but your concept is right. BCrypt and SCrypt are originally designed to be slow.

PBKDF2 is the function that takes a fast hash function and applies it many times to make it slow.

Or Argon2 as it fits the theme of the SHA-3 competition better (using chacha20 internally, similar to the BLAKE candidate).

No, being fast is good in this case. Password hashing is a different beast, with a different competition: https://password-hashing.net

Highly recommend using Argon2id/Argon2d/scrypt/bcrypt/PBKDF2 (in that order of preference) for password authentication/"storage." While SHA-3 might be slower than other fast hash functions, it's not at all designed for the same purpose. Functions suitable for password authentication are not merely CPU-intensive, but also memory-intensive.

Shameless plug: https://patrickmn.com/security/storing-passwords-securely/#n...

This is a really great discussion of the difference between hashing and secure password storage, would highly suggest reading: https://blog.tjll.net/please-stop-hashing-passwords/

From the SHA3 Round 1 results: "NIST expects SHA-3 to offer improved performance over the SHA-2 family of hash algorithms at a given security strength"

You want hashes to be fast, and KDFs to be slow.

KDF != PB-KDF / password hashes. There is no need that a KDF needs to be slow, e.g. you want fast handshakes for protocols (e.g. TLS), not slow handshakes.

Reply on news.ycombinator.com