NIST, the US-based National Institute for Standards and Technology, has selected the Keccak ("catch-ack") algorithm to become the formally recognised SHA-3 hash algorithm.
NIST announced a competition in 2007 to find a new cryptographic hash algorithm, amid fears that flaws may be found in the current SHA-2. Although SHA-2 is still believed to be secure, a stronger and fundamentally different process would provide a successor in case any weakness was found, as it has been in MD5, SHA-0 and SHA-1.
Cryptographic hashes are used to create unique digests of digital content, which can be used to positively identify them later. Digital signatures, passwords, and message/file authentication are common uses for hashes.
From 64 initial entries submitted by cryptographers around the world, NIST whittled the candidates down based on peer review, identifying cryptographic weaknesses and inefficiencies in algorithm design. The candidates were expected to deliver not only secure hashes, but also performance advantages when implemented in either software or hardware (such as when embedded in mobile devices).
The final round, in 2010, narrowed the list to five, including Skein, created by well-known cryptographic expert Bruce Schneier. This month, Keccak was formally announced as the winner. The other algorithms may well find their way into private implementations, since they have survived intense scrutiny and may offer benefits in specific implementations.
Keccak was singled out, NIST said, for its "elegant design and its ability to run well on many different computing devices". The algorithm is particularly fast when implemented in hardware, NIST said.
"Keccak has the added advantage of not being vulnerable in the same ways SHA-2 might be," said NIST computer security expert Tim Polk. "An attack that could work on SHA-2 most likely would not work on Keccak, because the two algorithms are designed so differently."
Share