Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a hash function for 2030 and beyond: SHA-2 vs. SHA-3 vs. BLAKE3

kerkour.com

Post reply on HN
Print view View original

21–22 of 22 posts

Re: Choosing a hash function for 2030 and beyond: SHA-2 vs. SHA-3 vs. BLAKE3

#21

Post by EnPissant »

oconnor663 wrote: post #15
EnPissant wrote: post #9

Earlier quoted context omitted.

> If you have a file and the BLAKE3 hash of that file, you can generate a proof that a portion of the file is correct This seems wrong to me? I would expect you could only verify the entire file.

This is a difference between BLAKE3 and most other hash functions. In the usual arrangement ("Merkle–Damgård"), each block depends on the previous one, so the only way to verify some "slice" of the input is to re-hash the whole thing. But when you arrange the input into a tree shape (a "Merkle tree") instead, suddenly the right half of the tree does not depend on the left half until the very last step at the very top…

Yeah, I was objecting to this part:

> If you have a file and the BLAKE3 hash of that file

To me that means the final hash. If you have the full tree of hashes that is a different story!

PS. Thanks for making BLAKE3! I use it in several pieces of software.

Re: Choosing a hash function for 2030 and beyond: SHA-2 vs. SHA-3 vs. BLAKE3

#22

Post by oconnor663 »

robobully wrote: post #18
scatbot wrote: post #13

Earlier quoted context omitted.

Not really. BLAKE3 isn’t a reduced-round tweak of BLAKE2 like K12 is for Keccak. It's a different construction that still meets its full security target. K12 and TurboSHAKE on the other hand are literally the same permutation with fewer rounds, which actually reduces Keccak's security margin. The situations are not really comparable.

> BLAKE3 isn’t a reduced-round tweak of BLAKE2 It's a different construction My initial argument was meant to highlight the difference between BLAKE and its successors. However, I have no idea what you back your statements with, BLAKE3 in fact _is_ BLAKE2s with reduced round + tree-based structure on top of it. The authors even directly mention it in the spec. > K12 and TurboSHAKE on the other hand are literally the…

> similar to what Bao encoding is used for in BLAKE3

In my mind Sakura and Bao are doing very different things. Sakura is a general framework for defining sound hash functions, while Bao is a BLAKE3-specific interleaving of hash function input and output that let's you do partial/streaming verification.

There was an interesting issue where it turned out that the Sakura security properties (which I studied while I was working on Bao, very helpful) weren't sufficient for what Bao wanted to do. I didn't realize that until a couple colleagues pointed it out years later. Luckily it didn't turn out to be a break in practice: https://github.com/oconnor663/bao/issues/41

Post reply on HN