View source for NIST hash function competition

The '''NIST hash function competition''' was an open competition held by the US [[National Institute of Standards and Technology]] (NIST) to develop a new [[hash function]] called [[SHA-3]] to complement the older [[SHA-1]] and [[SHA-2]]. The competition was formally announced in the ''[[Federal Register]]'' on November 2, 2007. "NIST is initiating an effort to develop one or more additional hash algorithms through a public competition, similar to the [[Advanced Encryption Standard process|development process]] for the [[Advanced Encryption Standard]] (AES)." The competition ended on October 2, 2012 when the NIST announced that [[Keccak]] would be the new SHA-3 hash algorithm.

The winning hash function has been published as NIST FIPS 202 the "[[SHA-3]] Standard", to complement FIPS 180-4, the ''[[Secure Hash Standard]]''.

The NIST competition has inspired other competitions such as the [[Password Hashing Competition]].

==Process==
Submissions were due October 31, 2008 and the list of candidates accepted for the first round was published on December 9, 2008. NIST held a conference in late February 2009 where submitters presented their algorithms and NIST officials discussed criteria for narrowing down the field of candidates for Round 2. The list of 14 candidates accepted to Round 2 was published on July 24, 2009. Another conference was held on August 23–24, 2010 (after [[International Cryptology Conference|CRYPTO]] 2010) at the [[University of California, Santa Barbara]], where the second-round candidates were discussed. The announcement of the final round candidates occurred on December 10, 2010. On October 2, 2012, the NIST announced its winner, choosing [[Keccak]], created by Guido Bertoni, Joan Daemen, and Gilles Van Assche of STMicroelectronics and Michaël Peeters of NXP.

===Finalists===
NIST selected five SHA-3 candidate algorithms to advance to the third (and final) round:
*[[BLAKE (hash function)|BLAKE]] (Aumasson et al.)
*[[Grøstl]] ([[Lars Knudsen|Knudsen]] et al.)
*[[JH (hash function)|JH]] (Hongjun Wu)
*[[Keccak]] (Keccak team, [[Joan Daemen|Daemen]] et al.)
*[[Skein (hash function)|Skein]] ([[Bruce Schneier|Schneier]] et al.)

NIST noted some factors that figured into its selection as it announced the finalists:

*Performance: "A couple of algorithms were wounded or eliminated by very large [hardware gate] area requirement – it seemed that the area they required precluded their use in too much of the potential application space."
*Security: "We preferred to be conservative about security, and in some cases did not select algorithms with exceptional performance, largely because something about them made us 'nervous,' even though we knew of no clear attack against the full algorithm."
*Analysis: "NIST eliminated several algorithms because of the extent of their second-round tweaks or because of a relative lack of reported cryptanalysis – either tended to create the suspicion that the design might not yet be fully tested and mature."
*Diversity: The finalists included hashes based on different modes of operation, including the HAIFA and [[sponge function]] constructions, and with different internal structures, including ones based on AES, bitslicing, and alternating XOR with addition.

NIST has released a report explaining its evaluation algorithm-by-algorithm.

===Did not pass to Final Round===
The following hash function submissions were accepted for Round Two, but did not make it to the final round. As noted in the announcement of the finalists, "none of these candidates was clearly broken".

*Blue Midnight Wish
*[[CubeHash]] ([[Daniel J. Bernstein|Bernstein]])
*ECHO ([[France Telecom]])
*[[Fugue (hash function)|Fugue]] ([[IBM]])
*Hamsi
*Luffa
*Shabal
*SHAvite-3
*[[SIMD (hash function)|SIMD]]

===Did not pass to Round Two===
The following hash function submissions were accepted for Round One but did not pass to Round Two. They have neither been conceded by the submitters nor have had substantial cryptographic weaknesses. However, most of them have some weaknesses in the design components, or performance issues.

*ARIRANG (CIST – Korea University)
*CHI
*CRUNCH
*[[Fast Syndrome Based Hash|FSB]]
*[[Lane (hash function)|Lane]]
*Lesamnta
*[[MD6]] ([[Ron Rivest|Rivest]] et al.)
*[[SANDstorm]] ([[Sandia National Laboratories]])
*Sarmal
*[[SWIFFT]]X
*TIB3

====Entrants with substantial weaknesses====
The following non-conceded Round One entrants have had substantial cryptographic weaknesses announced:

*AURORA ([[Sony]] and [[Nagoya University]])
*Blender
*Cheetah
*Dynamic SHA
*Dynamic SHA2
*[[Elliptic curve only hash|ECOH]]
*Edon-R
*EnRUPT
*ESSENCE
*LUX
*MCSSHA-3
*[[NaSHA (hash function)|NaSHA]]
*Sgàil
*[[Spectral Hash]]
*Twister
*Vortex

====Conceded entrants====
The following Round One entrants have been officially retracted from the competition by their submitters; they are considered broken according to the [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html NIST official Round One Candidates web site]. As such, they are withdrawn from the competition.

*Abacus
*Boole
*DCH
*Khichidi-1
*MeshHash
*SHAMATA
*StreamHash
*Tangle
*WaMM
*Waterfall

===Rejected entrants===
Several submissions received by NIST were not accepted as First Round Candidates, following an internal review by NIST. but only the following are public.

*HASH 2X
*Maraca
*MIXIT
*NKS 2D
*Ponic
*ZK-Crypt

==See also==

*[[Advanced Encryption Standard process]]

==Source==

[http://wikipedia.org/ http://wikipedia.org/]
[[Category:Cryptography]]