Hacker News Reader

Comment by maqp | Hacker News Reader

Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement.

To quote Wikipedia:

>BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).

https://en.wikipedia.org/wiki/BLAKE_(hash_function)#BLAKE2

Reducing the rounds by 4 might raise eyebrows wrt security, but Aumasson's 'Too Much Crypto' discusses BLAKE vs BLAKE2 among other things: https://eprint.iacr.org/2019/1492.pdf

Why kernel devs didn't go with BLAKE3, I can't say.

View on HN

Blake3 is still quite new (although it is a tested core) so I would say they made the right call.

It would only result in small incremental perf improvement due to reduced number of rounds (10 to 7).

Majority of Blake3's perf benefit manifests from merkle-tree structure and SIMD processing of multiple input streams at the same time.

> Why they didn't go with BLAKE3, I can't say.

Maybe people just liked it better that way?

BLAKE3 is written in Rust wile BLAKE2s is written in C. That is probably a lot easier to push through.

It also seems to be almost as fast according to the BLAKE3 specs PDF (page 11).

https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blak...

BLAKE3 has a C implementation including many SIMD implementations. The C implementation only lacks multi-threading which BLAKE2 does not have.

Giantrobot was going for a They Might Be Giants song reference

I picked up on that reference too. I was about to type it up when I saw your comment. I think it went over a lot of heads.

Well, the singers might be giants after all.

TMBG was a cover; It was The Four Lads originally I believe

Don't. Think. Posts. Below. Got. Joke.

It's BLAKE2, though BLAKE3 was hopeful,

but it just BLAKE2, BLAKE3 got a nope

SHA1's a long time gone, that crypto's a slowpoke

Why did BLAKE3 and SHA1 get the works?

That's nobody's business, even Turks!

claps :D

> Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement.

To add to this: BLAKE2 is derived from BLAKE only, whereas BLAKE3 is derived from Bao AND BLAKE2.

> Why kernel devs didn't go with BLAKE3, I can't say.

https://news.ycombinator.com/item?id=29748581

Your doubly linked comment (adrian_b’s remark) makes the incorrect assertion that the only reason blake3 is faster than blake2 is parallelism; this is objectively false. Blake3 uses fewer rounds (7x2) of the Chacha primitive than blake2 (10x2).

I think tptacek has it right: this thing is used very infrequently (period 300 seconds) and blake2 was already in the kernel, so they just reused it. It’s adequately fast, even if blake3 would be marginally faster.

I do not think that he claimed that the reason is performance, but regardless, I gave other reasons besides performance, too, including "blake2 was already in the kernel, so they just reused it". I said: "BLAKE2 is already in the kernel (with tests and everything), while BLAKE3 is not (at all)".

Yes, we agree here.

Thanks for the correction.

Reply on news.ycombinator.com