Comparison of cryptographic hash functions

From Wikipedia, the free encyclopedia

The following tables compare general and technical information for a number of cryptographic hash functions. See the individual functions' articles for further information. This article is not all-inclusive or necessarily up-to-date. An overview of hash function security/cryptanalysis can be found at hash function security summary.

General information

Basic general information about the cryptographic hash functions: year, designer, references, etc.

Function	Year	Designer	Derived from	Reference
BLAKE	2008	Jean-Philippe Aumasson Luca Henzen Willi Meier Raphael C.-W. Phan	ChaCha20	Website Specification
BLAKE2	2012	Jean-Philippe Aumasson Samuel Neves Zooko Wilcox-O'Hearn Christian Winnerlein	BLAKE	Website Specification RFC 7693
BLAKE3	2020	Jack O'Connor Jean-Philippe Aumasson Samuel Neves Zooko Wilcox-O'Hearn	BLAKE2	Website Specification
GOST R 34.11-94	1994	FAPSI and VNIIstandart	GOST 28147-89	RFC 5831
HAVAL	1992	Yuliang Zheng Josef Pieprzyk Jennifer Seberry		Website Specification
KangarooTwelve	2016	Guido Bertoni Joan Daemen Michaël Peeters Gilles Van Assche	Keccak	Website Specification
MD2	1989	Ronald Rivest		RFC 1319
MD4	1990			RFC 1320
MD5	1992		MD4	RFC 1321
MD6	2008			Website Specification
RIPEMD	1992	The RIPE Consortium^[1]	MD4
RIPEMD-128 RIPEMD-256 RIPEMD-160 RIPEMD-320	1996	Hans Dobbertin Antoon Bosselaers Bart Preneel	RIPEMD	Website Specification
SHA-0	1993	NSA		SHA-0
SHA-1	1995		SHA-0	Specification
SHA-256 SHA-384 SHA-512	2002
SHA-224	2004
SHA-3 (Keccak)	2008	Guido Bertoni Joan Daemen Michaël Peeters Gilles Van Assche	RadioGatún	Website Specification
Streebog	2012	FSB, InfoTeCS JSC		RFC 6986
Tiger	1995	Ross Anderson Eli Biham		Website Specification
Whirlpool	2004	Vincent Rijmen Paulo Barreto		Website

Parameters

Algorithm	Output size (bits)	Internal state size^{[note 1]}	Block size	Length size	Word size	Rounds
BLAKE2b	512	512	1024	128^{[note 2]}	64	12
BLAKE2s	256	256	512	64^{[note 3]}	32	10
BLAKE3	Unlimited^{[note 4]}	256^{[note 5]}	512	64	32	7
GOST	256	256	256	256	32	32
HAVAL	256/224/192/160/128	256	1024	64	32	3/4/5
MD2	128	384	128	–	32	18
MD4	128	128	512	64	32	3
MD5	128	128	512	64	32	64
PANAMA	256	8736	256	–	32	–
RadioGatún	Unlimited^{[note 6]}	58 words	19 words^{[note 7]}	–	1–64^{[note 8]}	18^{[note 9]}
RIPEMD	128	128	512	64	32	48
RIPEMD-128, -256	128/256	128/256	512	64	32	64
RIPEMD-160	160	160	512	64	32	80
RIPEMD-320	320	320	512	64	32	80
SHA-0	160	160	512	64	32	80
SHA-1	160	160	512	64	32	80
SHA-224, -256	224/256	256	512	64	32	64
SHA-384, -512, -512/224, -512/256	384/512/224/256	512	1024	128	64	80
SHA-3	224/256/384/512^{[note 10]}	1600	1600 - 2*bits	–^{[note 11]}	64	24
SHA3-224	224	1600	1152	–	64	24
SHA3-256	256	1600	1088	–	64	24
SHA3-384	384	1600	832	–	64	24
SHA3-512	512	1600	576	–	64	24
Tiger(2)-192/160/128	192/160/128	192	512	64	64	24
Whirlpool	512	512	512	256	8	10

Notes

^ The internal state here means the "internal hash sum" after each compression of a data block. Most hash algorithms also internally use some additional variables such as length of the data compressed so far since that is needed for the length padding in the end. See the Merkle–Damgård construction for details.
^ The size of BLAKE2b's message length counter is 128-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 128-bit length size would suggest (one byte equaling eight bits). A length size of 131-bit is the comparable length size ( $8\times 2^{128}=2^{131}$ ).
^ The size of BLAKE2s's message length counter is 64-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 64-bit length size would suggest (one byte equaling eight bits). A length size of 67-bit is the comparable length size ( $8\times 2^{64}=2^{67}$ ).
^ It's technically 2⁶⁴ bytes which equals 2⁶⁷ bits^[2]
^ The full BLAKE3 incremental state includes a chaining value stack up to 1728 bytes in size. However, the compression function itself does not access this stack. A smaller stack can also be used if the maximum input length is restricted.
^ RadioGatún is an extendable-output function which means it has an output of unlimited size. The official test vectors are 256-bit hashes. RadioGatún claims to have the security level of a cryptographic sponge function 19 words in size, which means the 32-bit version has the security of a 304-bit hash when looking at preimage attacks, but the security of a 608-bit hash when looking at collision attacks. The 64-bit version, likewise, has the security of a 608-bit or 1216-bit hash. For the purposes of determining how vulnerable RadioGatún is to length extension attacks, only two words of its 58-word state are output between hash compression operations.
^ RadioGatún is not a Merkle–Damgård construction and, as such, does not have a block size. Its belt is 39 words in size; its mill, which is the closest thing RadioGatún has to a "block", is 19 words in size.
^ Only the 32-bit and 64-bit versions of RadioGatún have official test vectors
^ The 18 blank rounds are only applied once in RadioGatún, between the end of the input mapping stage and before the generation of output bits
^ Although the underlying algorithm Keccak has arbitrary hash lengths, the NIST specified 224, 256, 384 and 512 bits output as valid modes for SHA-3.
^ Implementation dependent; as per section 7, second paragraph from the bottom of page 22, of FIPS PUB 202.

Compression function

The following tables compare technical information for compression functions of cryptographic hash functions. The information comes from the specifications, please refer to them for more details.

Function	Size (bits)^{[note 1]}						Words × Passes = Rounds^{[note 2]}	Operations^{[note 3]}	Endian^{[note 4]}
Function	Word	Digest	Chaining values^{[note 5]}	Computation values^{[note 6]}	Block	Length ^{[note 7]}	Words × Passes = Rounds^{[note 2]}	Operations^{[note 3]}	Endian^{[note 4]}
GOST R 34.11-94	32	×8 = 256			×8 = 256	32	4	A B L S	Little
HAVAL-3-128	32	×4 = 128	×8 = 256		×32 = 1,024	64	32 × 3 = 96	A B S	Little
HAVAL-3-160		×5 = 160
HAVAL-3-192		×6 = 192
HAVAL-3-224		×7 = 224
HAVAL-3-256		×8 = 256
HAVAL-4-128		×4 = 128					32 × 4 = 128
HAVAL-4-160		×5 = 160
HAVAL-4-192		×6 = 192
HAVAL-4-224		×7 = 224
HAVAL-4-256		×8 = 256
HAVAL-5-128		×4 = 128					32 × 5 = 160
HAVAL-5-160		×5 = 160
HAVAL-5-192		×6 = 192
HAVAL-5-224		×7 = 224
HAVAL-5-256		×8 = 256
MD2	8	×16 = 128	×32 = 256	×48 = 384	×16 = 128	None	48 × 18 = 864	B	N/A
MD4	32	×4 = 128			×16 = 512	64	16 × 3 = 48	A B S	Little
MD5	32	×4 = 128			×16 = 512	64	16 × 4 = 64	A B S	Little
RIPEMD	32	×4 = 128		×8 = 256	×16 = 512	64	16 × 3 = 48	A B S	Little
RIPEMD-128		×4 = 128					16 × 4 = 64
RIPEMD-256		×8 = 256					16 × 4 = 64
RIPEMD-160		×5 = 160		×10 = 320			16 × 5 = 80
RIPEMD-320		×10 = 320		×10 = 320			16 × 5 = 80
SHA-0	32	×5 = 160			×16 = 512	64	16 × 5 = 80	A B S	Big
SHA-1		×5 = 160					16 × 5 = 80
SHA-256		×8 = 256	×8 = 256				16 × 4 = 64
SHA-224		×7 = 224	×8 = 256				16 × 4 = 64
SHA-512	64	×8 = 512	×8 = 512		×16 = 1024	128	16 × 5 = 80
SHA-384	64	×6 = 384	×8 = 512		×16 = 1024	128	16 × 5 = 80
Tiger-192	64	×3 = 192	×3 = 192		×8 = 512	64	8 × 3 = 24	A B L S	Not Specified
Tiger-160		×2.5=160
Tiger-128		×2 = 128
Function	Word	Digest	Chaining values	Computation values	Block	Length	Words × Passes = Rounds	Operations	Endian
Function	Size (bits)						Words × Passes = Rounds	Operations	Endian

Notes

^ The omitted multiplicands are word sizes.
^ Some authors interchange passes and rounds.
^ A: addition, subtraction; B: bitwise operation; L: lookup table; S: shift, rotation.
^ It refers to byte endianness only. If the operations consist of bitwise operations and lookup tables only, the endianness is irrelevant.
^ The size of message digest equals to the size of chaining values usually. In truncated versions of certain cryptographic hash functions such as SHA-384, the former is less than the latter.
^ The size of chaining values equals to the size of computation values usually. In certain cryptographic hash functions such as RIPEMD-160, the former is less than the latter because RIPEMD-160 use two sets of parallel computation values and then combine into a single set of chaining values.
^ The maximum input size = 2^{length size} − 1 bits. For example, the maximum input size of SHA-1 = 2⁶⁴ − 1 bits.

References

^ Dobbertin, Hans; Bosselaers, Antoon; Preneel, Bart (21–23 February 1996). RIPEMD-160: A strengthened version of RIPEMD (PDF). Fast Software Encryption. Third International Workshop. Cambridge, UK. pp. 71–82. doi:10.1007/3-540-60865-6_44.
^ https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf page 8

External links

ECRYPT Benchmarking of Cryptographic Hashes – measurements of hash function speed on various platforms
The ECRYPT Hash Function Website – A wiki for cryptographic hash functions
SHA-3 Project – Information about SHA-3 competition

The following tables compare general and technical information for a number of cryptographic hash functions. See the individual functions' articles for further information. This article is not all-inclusive or necessarily up-to-date. An overview of hash function security/cryptanalysis can be found at hash function security summary.

General information

Basic general information about the cryptographic hash functions: year, designer, references, etc.

Function	Year	Designer	Derived from	Reference
BLAKE	2008	Jean-Philippe Aumasson Luca Henzen Willi Meier Raphael C.-W. Phan	ChaCha20	Website Specification
BLAKE2	2012	Jean-Philippe Aumasson Samuel Neves Zooko Wilcox-O'Hearn Christian Winnerlein	BLAKE	Website Specification RFC 7693
BLAKE3	2020	Jack O'Connor Jean-Philippe Aumasson Samuel Neves Zooko Wilcox-O'Hearn	BLAKE2	Website Specification
GOST R 34.11-94	1994	FAPSI and VNIIstandart	GOST 28147-89	RFC 5831
HAVAL	1992	Yuliang Zheng Josef Pieprzyk Jennifer Seberry		Website Specification
KangarooTwelve	2016	Guido Bertoni Joan Daemen Michaël Peeters Gilles Van Assche	Keccak	Website Specification
MD2	1989	Ronald Rivest		RFC 1319
MD4	1990			RFC 1320
MD5	1992		MD4	RFC 1321
MD6	2008			Website Specification
RIPEMD	1992	The RIPE Consortium^[1]	MD4
RIPEMD-128 RIPEMD-256 RIPEMD-160 RIPEMD-320	1996	Hans Dobbertin Antoon Bosselaers Bart Preneel	RIPEMD	Website Specification
SHA-0	1993	NSA		SHA-0
SHA-1	1995		SHA-0	Specification
SHA-256 SHA-384 SHA-512	2002
SHA-224	2004
SHA-3 (Keccak)	2008	Guido Bertoni Joan Daemen Michaël Peeters Gilles Van Assche	RadioGatún	Website Specification
Streebog	2012	FSB, InfoTeCS JSC		RFC 6986
Tiger	1995	Ross Anderson Eli Biham		Website Specification
Whirlpool	2004	Vincent Rijmen Paulo Barreto		Website

Parameters

Algorithm	Output size (bits)	Internal state size^{[note 1]}	Block size	Length size	Word size	Rounds
BLAKE2b	512	512	1024	128^{[note 2]}	64	12
BLAKE2s	256	256	512	64^{[note 3]}	32	10
BLAKE3	Unlimited^{[note 4]}	256^{[note 5]}	512	64	32	7
GOST	256	256	256	256	32	32
HAVAL	256/224/192/160/128	256	1024	64	32	3/4/5
MD2	128	384	128	–	32	18
MD4	128	128	512	64	32	3
MD5	128	128	512	64	32	64
PANAMA	256	8736	256	–	32	–
RadioGatún	Unlimited^{[note 6]}	58 words	19 words^{[note 7]}	–	1–64^{[note 8]}	18^{[note 9]}
RIPEMD	128	128	512	64	32	48
RIPEMD-128, -256	128/256	128/256	512	64	32	64
RIPEMD-160	160	160	512	64	32	80
RIPEMD-320	320	320	512	64	32	80
SHA-0	160	160	512	64	32	80
SHA-1	160	160	512	64	32	80
SHA-224, -256	224/256	256	512	64	32	64
SHA-384, -512, -512/224, -512/256	384/512/224/256	512	1024	128	64	80
SHA-3	224/256/384/512^{[note 10]}	1600	1600 - 2*bits	–^{[note 11]}	64	24
SHA3-224	224	1600	1152	–	64	24
SHA3-256	256	1600	1088	–	64	24
SHA3-384	384	1600	832	–	64	24
SHA3-512	512	1600	576	–	64	24
Tiger(2)-192/160/128	192/160/128	192	512	64	64	24
Whirlpool	512	512	512	256	8	10

Notes

^ The internal state here means the "internal hash sum" after each compression of a data block. Most hash algorithms also internally use some additional variables such as length of the data compressed so far since that is needed for the length padding in the end. See the Merkle–Damgård construction for details.
^ The size of BLAKE2b's message length counter is 128-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 128-bit length size would suggest (one byte equaling eight bits). A length size of 131-bit is the comparable length size ( $8\times 2^{128}=2^{131}$ ).
^ The size of BLAKE2s's message length counter is 64-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 64-bit length size would suggest (one byte equaling eight bits). A length size of 67-bit is the comparable length size ( $8\times 2^{64}=2^{67}$ ).
^ It's technically 2⁶⁴ bytes which equals 2⁶⁷ bits^[2]
^ The full BLAKE3 incremental state includes a chaining value stack up to 1728 bytes in size. However, the compression function itself does not access this stack. A smaller stack can also be used if the maximum input length is restricted.
^ RadioGatún is an extendable-output function which means it has an output of unlimited size. The official test vectors are 256-bit hashes. RadioGatún claims to have the security level of a cryptographic sponge function 19 words in size, which means the 32-bit version has the security of a 304-bit hash when looking at preimage attacks, but the security of a 608-bit hash when looking at collision attacks. The 64-bit version, likewise, has the security of a 608-bit or 1216-bit hash. For the purposes of determining how vulnerable RadioGatún is to length extension attacks, only two words of its 58-word state are output between hash compression operations.
^ RadioGatún is not a Merkle–Damgård construction and, as such, does not have a block size. Its belt is 39 words in size; its mill, which is the closest thing RadioGatún has to a "block", is 19 words in size.
^ Only the 32-bit and 64-bit versions of RadioGatún have official test vectors
^ The 18 blank rounds are only applied once in RadioGatún, between the end of the input mapping stage and before the generation of output bits
^ Although the underlying algorithm Keccak has arbitrary hash lengths, the NIST specified 224, 256, 384 and 512 bits output as valid modes for SHA-3.
^ Implementation dependent; as per section 7, second paragraph from the bottom of page 22, of FIPS PUB 202.

Compression function

The following tables compare technical information for compression functions of cryptographic hash functions. The information comes from the specifications, please refer to them for more details.

Function	Size (bits)^{[note 1]}						Words × Passes = Rounds^{[note 2]}	Operations^{[note 3]}	Endian^{[note 4]}
Function	Word	Digest	Chaining values^{[note 5]}	Computation values^{[note 6]}	Block	Length ^{[note 7]}	Words × Passes = Rounds^{[note 2]}	Operations^{[note 3]}	Endian^{[note 4]}
GOST R 34.11-94	32	×8 = 256			×8 = 256	32	4	A B L S	Little
HAVAL-3-128	32	×4 = 128	×8 = 256		×32 = 1,024	64	32 × 3 = 96	A B S	Little
HAVAL-3-160		×5 = 160
HAVAL-3-192		×6 = 192
HAVAL-3-224		×7 = 224
HAVAL-3-256		×8 = 256
HAVAL-4-128		×4 = 128					32 × 4 = 128
HAVAL-4-160		×5 = 160
HAVAL-4-192		×6 = 192
HAVAL-4-224		×7 = 224
HAVAL-4-256		×8 = 256
HAVAL-5-128		×4 = 128					32 × 5 = 160
HAVAL-5-160		×5 = 160
HAVAL-5-192		×6 = 192
HAVAL-5-224		×7 = 224
HAVAL-5-256		×8 = 256
MD2	8	×16 = 128	×32 = 256	×48 = 384	×16 = 128	None	48 × 18 = 864	B	N/A
MD4	32	×4 = 128			×16 = 512	64	16 × 3 = 48	A B S	Little
MD5	32	×4 = 128			×16 = 512	64	16 × 4 = 64	A B S	Little
RIPEMD	32	×4 = 128		×8 = 256	×16 = 512	64	16 × 3 = 48	A B S	Little
RIPEMD-128		×4 = 128					16 × 4 = 64
RIPEMD-256		×8 = 256					16 × 4 = 64
RIPEMD-160		×5 = 160		×10 = 320			16 × 5 = 80
RIPEMD-320		×10 = 320		×10 = 320			16 × 5 = 80
SHA-0	32	×5 = 160			×16 = 512	64	16 × 5 = 80	A B S	Big
SHA-1		×5 = 160					16 × 5 = 80
SHA-256		×8 = 256	×8 = 256				16 × 4 = 64
SHA-224		×7 = 224	×8 = 256				16 × 4 = 64
SHA-512	64	×8 = 512	×8 = 512		×16 = 1024	128	16 × 5 = 80
SHA-384	64	×6 = 384	×8 = 512		×16 = 1024	128	16 × 5 = 80
Tiger-192	64	×3 = 192	×3 = 192		×8 = 512	64	8 × 3 = 24	A B L S	Not Specified
Tiger-160		×2.5=160
Tiger-128		×2 = 128
Function	Word	Digest	Chaining values	Computation values	Block	Length	Words × Passes = Rounds	Operations	Endian
Function	Size (bits)						Words × Passes = Rounds	Operations	Endian

Notes

^ The omitted multiplicands are word sizes.
^ Some authors interchange passes and rounds.
^ A: addition, subtraction; B: bitwise operation; L: lookup table; S: shift, rotation.
^ It refers to byte endianness only. If the operations consist of bitwise operations and lookup tables only, the endianness is irrelevant.
^ The size of message digest equals to the size of chaining values usually. In truncated versions of certain cryptographic hash functions such as SHA-384, the former is less than the latter.
^ The size of chaining values equals to the size of computation values usually. In certain cryptographic hash functions such as RIPEMD-160, the former is less than the latter because RIPEMD-160 use two sets of parallel computation values and then combine into a single set of chaining values.
^ The maximum input size = 2^{length size} − 1 bits. For example, the maximum input size of SHA-1 = 2⁶⁴ − 1 bits.

References

^ Dobbertin, Hans; Bosselaers, Antoon; Preneel, Bart (21–23 February 1996). RIPEMD-160: A strengthened version of RIPEMD (PDF). Fast Software Encryption. Third International Workshop. Cambridge, UK. pp. 71–82. doi:10.1007/3-540-60865-6_44.
^ https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf page 8

External links

ECRYPT Benchmarking of Cryptographic Hashes – measurements of hash function speed on various platforms
The ECRYPT Hash Function Website – A wiki for cryptographic hash functions
SHA-3 Project – Information about SHA-3 competition

[2] The internal state here means the "internal hash sum" after each compression of a data block. Most hash algorithms also internally use some additional variables such as length of the data compressed so far since that is needed for the length padding in the end. See the Merkle–Damgård construction for details.

[3] The size of BLAKE2b's message length counter is 128-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 128-bit length size would suggest (one byte equaling eight bits). A length size of 131-bit is the comparable length size ( $8\times 2^{128}=2^{131}$ ).

[4] The size of BLAKE2s's message length counter is 64-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 64-bit length size would suggest (one byte equaling eight bits). A length size of 67-bit is the comparable length size ( $8\times 2^{64}=2^{67}$ ).

[6] It's technically 2⁶⁴ bytes which equals 2⁶⁷ bits^[2]

[7] The full BLAKE3 incremental state includes a chaining value stack up to 1728 bytes in size. However, the compression function itself does not access this stack. A smaller stack can also be used if the maximum input length is restricted.

[8] RadioGatún is an extendable-output function which means it has an output of unlimited size. The official test vectors are 256-bit hashes. RadioGatún claims to have the security level of a cryptographic sponge function 19 words in size, which means the 32-bit version has the security of a 304-bit hash when looking at preimage attacks, but the security of a 608-bit hash when looking at collision attacks. The 64-bit version, likewise, has the security of a 608-bit or 1216-bit hash. For the purposes of determining how vulnerable RadioGatún is to length extension attacks, only two words of its 58-word state are output between hash compression operations.

[9] RadioGatún is not a Merkle–Damgård construction and, as such, does not have a block size. Its belt is 39 words in size; its mill, which is the closest thing RadioGatún has to a "block", is 19 words in size.

[10] Only the 32-bit and 64-bit versions of RadioGatún have official test vectors

[11] The 18 blank rounds are only applied once in RadioGatún, between the end of the input mapping stage and before the generation of output bits

[12] Although the underlying algorithm Keccak has arbitrary hash lengths, the NIST specified 224, 256, 384 and 512 bits output as valid modes for SHA-3.

[13] Implementation dependent; as per section 7, second paragraph from the bottom of page 22, of FIPS PUB 202.

[14] The omitted multiplicands are word sizes.

[15] Some authors interchange passes and rounds.

[16] A: addition, subtraction; B: bitwise operation; L: lookup table; S: shift, rotation.

[17] It refers to byte endianness only. If the operations consist of bitwise operations and lookup tables only, the endianness is irrelevant.

[18] The size of message digest equals to the size of chaining values usually. In truncated versions of certain cryptographic hash functions such as SHA-384, the former is less than the latter.

[19] The size of chaining values equals to the size of computation values usually. In certain cryptographic hash functions such as RIPEMD-160, the former is less than the latter because RIPEMD-160 use two sets of parallel computation values and then combine into a single set of chaining values.

[20] The maximum input size = 2^{length size} − 1 bits. For example, the maximum input size of SHA-1 = 2⁶⁴ − 1 bits.

[1] Dobbertin, Hans; Bosselaers, Antoon; Preneel, Bart (21–23 February 1996). RIPEMD-160: A strengthened version of RIPEMD (PDF). Fast Software Encryption. Third International Workshop. Cambridge, UK. pp. 71–82. doi:10.1007/3-540-60865-6_44.

[5] ttps://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf page 8

[2] The internal state here means the "internal hash sum" after each compression of a data block. Most hash algorithms also internally use some additional variables such as length of the data compressed so far since that is needed for the length padding in the end. See the Merkle–Damgård construction for details.

[3] The size of BLAKE2b's message length counter is 128-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 128-bit length size would suggest (one byte equaling eight bits). A length size of 131-bit is the comparable length size ( $8\times 2^{128}=2^{131}$ ).

[4] The size of BLAKE2s's message length counter is 64-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 64-bit length size would suggest (one byte equaling eight bits). A length size of 67-bit is the comparable length size ( $8\times 2^{64}=2^{67}$ ).

[6] It's technically 2⁶⁴ bytes which equals 2⁶⁷ bits^[2]

[7] The full BLAKE3 incremental state includes a chaining value stack up to 1728 bytes in size. However, the compression function itself does not access this stack. A smaller stack can also be used if the maximum input length is restricted.

[8] RadioGatún is an extendable-output function which means it has an output of unlimited size. The official test vectors are 256-bit hashes. RadioGatún claims to have the security level of a cryptographic sponge function 19 words in size, which means the 32-bit version has the security of a 304-bit hash when looking at preimage attacks, but the security of a 608-bit hash when looking at collision attacks. The 64-bit version, likewise, has the security of a 608-bit or 1216-bit hash. For the purposes of determining how vulnerable RadioGatún is to length extension attacks, only two words of its 58-word state are output between hash compression operations.

[9] RadioGatún is not a Merkle–Damgård construction and, as such, does not have a block size. Its belt is 39 words in size; its mill, which is the closest thing RadioGatún has to a "block", is 19 words in size.

[10] Only the 32-bit and 64-bit versions of RadioGatún have official test vectors

[11] The 18 blank rounds are only applied once in RadioGatún, between the end of the input mapping stage and before the generation of output bits

[12] Although the underlying algorithm Keccak has arbitrary hash lengths, the NIST specified 224, 256, 384 and 512 bits output as valid modes for SHA-3.

[13] Implementation dependent; as per section 7, second paragraph from the bottom of page 22, of FIPS PUB 202.

[14] The omitted multiplicands are word sizes.

[15] Some authors interchange passes and rounds.

[16] A: addition, subtraction; B: bitwise operation; L: lookup table; S: shift, rotation.

[17] It refers to byte endianness only. If the operations consist of bitwise operations and lookup tables only, the endianness is irrelevant.

[18] The size of message digest equals to the size of chaining values usually. In truncated versions of certain cryptographic hash functions such as SHA-384, the former is less than the latter.

[19] The size of chaining values equals to the size of computation values usually. In certain cryptographic hash functions such as RIPEMD-160, the former is less than the latter because RIPEMD-160 use two sets of parallel computation values and then combine into a single set of chaining values.

[20] The maximum input size = 2^{length size} − 1 bits. For example, the maximum input size of SHA-1 = 2⁶⁴ − 1 bits.

[1] Dobbertin, Hans; Bosselaers, Antoon; Preneel, Bart (21–23 February 1996). RIPEMD-160: A strengthened version of RIPEMD (PDF). Fast Software Encryption. Third International Workshop. Cambridge, UK. pp. 71–82. doi:10.1007/3-540-60865-6_44.

[5] ttps://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf page 8

[1]

[note 1]

[note 2]

[note 3]

[note 4]

[note 5]

[note 6]

[note 7]

[note 8]

[note 9]

[note 10]

[note 11]

[2]

[note 1]

[note 2]

[note 3]

[note 4]

[note 5]

[note 6]

[note 7]

Comparison of cryptographic hash functions

General information

Parameters

Notes

Compression function

Notes

See also

References

External links

General information

Parameters

Notes

Compression function

Notes

See also

References

External links