SHA-3

SHA-3（第三代安全杂凑演算法，Secure Hash Algorithm 3），之前名为Keccak（或)）演算法，设计者宣称在 Intel Core 2 的CPU上面，此演算法的效能是12.6时钟周期每位元组（cycles per byte）。
SHA-3 在2015年8月5日由 NIST 通过 FIPS 202 正式发表。
设计.
Keccak 使用海绵函数，此函数会将资料与初始的内部状态做XOR运算，这是无可避免可置换的（inevitably permuted）。在最大的版本，演算法使用的内存状态是使用一个5×5的二维阵列，资料型态是64位元的字节，总计1600位元 。缩版的演算法使用比较小的，以2为幂次的字节大小"w"为1位元，总计使用25位元。除了使用较小的版本来研究加密分析攻击，比较适中的大小（例如从"w"=4使用100位元，到"w"=32使用800位元）则提供了比较实际且轻量的替代方案。
Keccak 的置换.
置换方法是先定义字的长度为二的某次方，"w" = 2ℓ位元。SHA-3的主要应用使用64位元的字长，ℓ = 6。
内存状态可以被视为5×5×"w"的三维阵列。令"a"["i"]["j"]["k"]代表内存状态的第("i"×5 + "j")×"w" + "k"个位元（使用小端序，little-endian，参见位元组序）。
置换函数是五个子段落（sub-round）作12+2ℓ次的回圈，每一个子段落都相当简单：
"m"−1] is exclusive-ORed with bit of a degree-8 LFSR sequence. This breaks the symmetry that is preserved by the other sub-rounds.
Hashing variable-length messages.
To absorb "r" bits of data, the data is XORed into the leading bits of the state, and the block permutation is applied. To squeeze, the first "r" bits of the state are produced as output, and the block permutation is applied if additional output is desired.
Central to this is the "capacity" of the hash function, which is the state bits that are not touched by input or output. This can be adjusted based on security requirements, but the SHA-3 proposal sets a conservative , where "n" is the size of the output hash. Thus "r", the number of message bits processed per block permutation, depends on the output hash size. The NIST submission sets the rate "r" as 1152, 1088, 832, or 576 (144, 136, 104 and 72 bytes) for 224, 256, 384 and 512-bit hash sizes, respectively. In April 2014, NIST pubished a draft that confirms these values. 
To ensure the message can be evenly divided into "r"-bit blocks, padding is required. The submission proposes the bit pattern 10*1: a 1 bit, zero or more 0 bits (maximum ), and a final 1 bit. The final 1 bit is required because the sponge construction security proof requires that the rate is encoded in the final block ("multi rate padding"). The current draft includes adding bits 01 to the message before the applying the padding. This provides domain separation from the SHAKE's, the other sponge modes included in the draft. For byte granularity data, this never increases the message size, since we have six unused bits anyways.
To compute a hash, initialize the state to 0, pad the input, and break it into "r"-bit pieces. Absorb the input into the state; that is, for each piece, XOR it into the state and then apply the block permutation.
After the final block permutation, the leading "n" bits of the state are the desired hash. Because "r" is always greater than "n", there is actually never a need for additional block permutations in the squeezing phase. However, arbitrary output length may be useful in applications such as optimal asymmetric encryption padding. In this case, "n" is a security parameter rather than the output size.
Although not part of the SHA-3 competition requirements, smaller variants of the block permutation can be used, for hash output sizes up to half their state size, if the rate r is limited appropriately. For example, a 256-bit hash can be computed using 25 32-bit words if (36 bytes per iteration).
修改.
在整个 NIST 杂凑函数比赛里面，参赛者允许稍微修改演算法解决已经出现的问题。Keccak 的修改有：
SHA 家族函数的比较.
在下面的表格中，“内部状态”指的是传递到下一个块的位数。