SHA-3

In the late 1970s, cryptographic hash functions began to take shape. These algorithms transform any data into a fixed-size digital fingerprint, used to verify data integrity and create digital signatures. In 1976, Diffie and Hellman published their seminal paper on public-key cryptography; they identified the need for a one-way hash function to construct digital signature schemes.

Between 1978 and 1979, Rabin, Yuval, and Merkle laid the theoretical foundations. Rabin proposed a design based on DES encryption with a 64-bit output. Yuval demonstrated that collisions for an n-bit hash function could be found in 2^n∕2 time using the birthday paradox. Merkle introduced the requirements for collision resistance, preimage resistance, and second preimage resistance, which remain the fundamental properties expected of a cryptographic hash function.

The 1990s saw the emergence of MD4 and MD5, designed by Ron Rivest, which became widely used standards. SHA-1, published by the NSA in 1995, established itself as MD5’s successor with a 160-bit output. SHA-2 arrived in 2001 with variants producing digests from 224 to 512 bits. These algorithms are based on the Merkle-Damgård construction: the input message is divided into fixed-size blocks to which a compression function is iteratively applied.

In 2004, Xiaoyun Wang’s team revolutionized the field by refining differential cryptanalysis to the point of making collision discovery for MD5 trivial. This work also significantly reduced SHA-1’s security. In 2008, a team managed to create a rogue CA certificate by exploiting MD5 weaknesses. The cryptographic community grew concerned about the robustness of existing hash functions. SHA-2 uses construction principles similar to SHA-1, raising questions about its future resistance.

NIST launched a public competition in 2007 to select a new algorithm that would become SHA-3. The specifications required that candidates support outputs of 224, 256, 384, and 512 bits to ensure compatibility with SHA-2. Submissions had to be royalty-free and usable worldwide without restrictions.

64 candidates were submitted in 2008, with 51 selected for the first round. By mid-2009, approximately half of the algorithms had been broken. This carnage demonstrated the difficulty of designing a secure and efficient hash function. In July 2009, NIST selected 14 candidates for the second round: Blake, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein.

The Keccak algorithm, developed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche, stood out for its innovative architecture based on the sponge construction. Unlike the Merkle-Damgård construction, this approach absorbs the message block by block with a portion called the “rate” of 1,152 bits, while the remaining 448 bits serve as a security parameter. The internal state forms a 5×5×64-bit cube totaling 1,600 bits.

In October 2012, NIST designated Keccak as the winner of the SHA-3 competition. The decision was based on its excellent hardware performance, comfortable security margin, and architecture distinct from other SHA algorithms. Standardization was completed in August 2015 with the publication of FIPS 202. SHA-3 includes four conventional hash functions (SHA3-224, SHA3-256, SHA3-384, and SHA3-512) as well as two extendable-output functions SHAKE128 and SHAKE256.

The first implementations of SHA-3 revealed interesting characteristics. On FPGA, the algorithm requires more hardware resources than SHA-1 but offers better cryptographic resistance. Performance tests indicate that SHA-3 is approximately 5.5 times slower than SHA-1 due to its increased complexity. For password cracking by brute force, a 6-character password requires a few minutes with SHA-1 versus over an hour with SHA-3.

The introduction of SHA-3 marks an evolution in the history of cryptographic hash functions. Its sponge construction breaks with the traditional approach and inspires new modes of use. The extendable-output functions SHAKE bring innovation: the digest size can be adapted to specific application needs. SHA-3 complements the SHA-2 family by providing architectural diversity that strengthens overall resilience against future cryptanalytic advances.

To date, SHA-3 has not suffered any significant attack undermining its security. Research continues to explore the possibilities offered by the sponge construction, particularly for designing authenticated cryptographic primitives. The success of the SHA-3 competition demonstrates the effectiveness of an open and collaborative approach to developing robust cryptographic standards. This methodology now serves as a model for other standardization initiatives in cryptography.