page_title: SHA-3
section_title: Design
hierarchical_section_title: SHA-3 / Design
context_page_description: SHA-3 is the latest member of the Secure Hash Algorithm family of standards, released by NIST on August 5, 2015. Although part of the same series of standards, SHA-3 is internally different from the MD5-like structure of SHA-1 and SHA-2.
  SHA-3 is a subset of the broader cryptographic primitive family Keccak, designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche, building upon RadioGatún. Keccak's authors have proposed additional uses for the function, not standardized by NIST, including a stream cipher, an authenticated encryption system, a "tree" hashing scheme for faster hashing on certain architectures, and AEAD ciphers Keyak and Ketje.
  Keccak is based on a novel approach called sponge construction. Sponge construction is based on a wide random function or random permutation, and allows inputting any amount of data, and outputting any amount of data, while acting as a pseudorandom function with regard to all previous inputs. This leads to great flexibility.
  NIST does not currently plan to withdraw SHA-2 or remove it from the revised Secure Hash Standard. The purpose of SHA-3 is that it can be
context_section_description: SHA-3 uses the sponge construction, in which data is "absorbed" into the sponge, then the result is "squeezed" out. In the absorbing phase, message blocks are XORed into a subset of the state, which is then transformed as a whole using a permutation function . In the "squeeze" phase, output blocks are read from the same subset of the state, alternated with the state transformation function . The size of the part of the state that is written and read is called the "rate" (denoted ), and the size of the part that is untouched by input/output is called the "capacity" (denoted ). The capacity determines the security of the scheme. The maximum security level is half the capacity.
  Given an input bit string , a padding function , a permutation function  that operates on bit blocks of width , a rate  and an output length , we have capacity  and the sponge construction , yielding a bit string  of length , works as follows:
  pad the input N using the pad function, yielding a padded bit string P with a length divisible by  (such that  is integer)
  break P into n consecutive r-bit pieces P₀, ..., Pₙ−1
  initialize the state S to a string of b zero bits
  absorb the input into the state: for each block Pᵢ:
  extend Pᵢ at the end by a string of c zero bits, yielding one of length b
  XOR that with S
  apply the block permutation f to the result, yielding a new state S
  initialize Z to be the empty string
  while the length of Z is less than d:
  append the first r bits of S to Z
  if Z is still less than d bits long, apply f to S, yielding a new state S
  truncate Z to d bits
  The fact that the internal state S contains c additional bits of information in addition to what is output to Z prevents the length extension attacks that SHA-2, SHA-1, MD5 and other hashes based on the Merkle–Damgård construction are susceptible to.
  In SHA-3, the state S consists of a 5 × 5 array of w-bit words (with w = 64), b = 5 × 5 × w = 5 × 5 × 64 = 1600 bits total. Keccak is also defined for smaller power-of-2 word sizes w down to 1 bit (total state of 25 bits). Small state sizes can be used to test cryptanalytic attacks, and intermediate state sizes (from w = 8, 200 bits, to w = 32, 800 bits) can be used in practical, lightweight applications.
  For SHA-3-224, SHA-3-256, SHA-3-384, and SHA-3-512 instances, r is greater than d, so there is no need for additional block permutations in the squeezing phase; the leading d bits of the state are the desired hash. However, SHAKE-128 and SHAKE-256 allow an arbitrary output length, which is useful in applications such as optimal asymmetric encryption padding.
caption: The sponge construction for hash functions. Pi are input, Zi are hashed output. The unused "capacity" c should be twice the desired resistance to collision or preimage attacks.