Monday, March 10, 2014

SHA-3, a sequel in the story of hash algorithms

This week I want to talk about Secure Hash Algorithm 3 (SHA-3), previously known as Keccak, as a hash function chosen as the successor to SHA-2. Cryptographic has functions are most commonly used for digital signing and authentication, more specifically, password management. The idea behind these functions is that they work like a "super" data scrambler, a good hash of a user's password can be easily generated, but it's infeasible to reverse engineer. For example, websites with login accounts will store the hashed version of a user's password as opposed to plain text. When that user would log into the system, they would compare the hashes of the already stored and just entered passwords to authenticate that user, instead of comparing the passwords themselves.

Example of how a small change in text can result in a completely different hash. Taken from: http://en.wikipedia.org/wiki/Cryptographic_hash_function

SHA-2 is currently the most commonly used hashing algorithm, but concerns about it's feasibility were raised in 2007. There was a competition held to find the next gen algorithm, and in 2012 it was the Keccak algorithm that won. The most interesting aspect of the SHA-3 solution is that it works in a completely different way then SHA-2, so even if SHA-2 was "cracked", it wouldn't get anyone any closer to cracking SHA-3. Since SHA-2 is still reliable, it's unlikely that systems already using it will jump to implement
SHA-3, but that's actually a good thing. Since there are two reliable hash functions now, malicious users trying to brute force their way into user accounts are first going have to figure out what hashing algorithm is being used.

NIST Tech Beat. (October 2, 2012). NIST Selects Winner of Secure Hash Algorithm (SHA-3) Competition. Retrieved March 10, 2014, from http://www.nist.gov/itl/csd/sha-100212.cfm.

1 comment:

  1. Very interesting piece on how hash algorithms can help increase security. You did an excellent job of detailing how these hash algorithms are implemented and it really gave me a good idea as to how difficult it can be to crack these codes. Also the competitions were a worthwhile addition and showed that algorithms are constantly being created to combat hackers.

    ReplyDelete