Reference code without debug/intermediate print-outs with some notes:
main () { Hash(); } binary size less 6320 bytes of the C run-time library and the headers.
cubehash ¦ 848 - stream hash, too slow, needs tuning down, n-speed*4 time preimage resistance?
enrupt ¦ 848 - fast, sream hash, was too fast, tuned up to s=8, extremely hardware efficient, fast in ASIC, fits in <500 gates + CMOS
mcssha3 ¦ 848 - is out: required update was not presented at the conference
streamhash ¦ 848 - is out: conceded broken
jh ¦ 1360 - fast, WP-MD
khichidi-1 ¦ 1360 - is out: conceded broken
shabal ¦ 1360 - narrow pipe, fast
abacus ¦ 1872 - is out: conceded broken
boole ¦ 1872 - is out: conceded broken
dch ¦ 1872 - is out: conceded broken
meshhash ¦ 1872 - is out: conceded broken
groestl ¦ 2384 - AES based, a bit too slow, needs tuning down
keccak ¦ 2896 - fast, stream hash (sponge), ultra fast in ASIC, but >5K gates
lux ¦ 2896 - AES based, 256-bit is a bit too slow, needs tuning down, 100/228 collisions? 200/456 preimages?
waterfall ¦ 2896 - is out: conceded broken
luffa ¦ 3408 - narrow pipe, 512-bit is a bit too slow, needs tuning down
tangle ¦ 3408 - is out: conceded broken
dynamicsha ¦ 3920 - narrow pipe, too slow, needs tuning down, 23/24 collisions?
shamata ¦ 3920 - is out: conceded broken
aurora ¦ 4402 - narrow pipe, AES based, 512-bit is a bit too slow, needs tuning down, 249 collisions? 291 preimages?
echo ¦ 4402 - AES based, too slow, needs tuning down
fugue ¦ 4402 - AES based, way too slow, needs tuning down
ponic* ¦ 4944 - is out: was not accepted
md6 ¦ 5456 - way too large, too slow, needs tuning down
nasha ¦ 5456 - narrow pipe, AES based, too slow, needs tuning down
cheetah ¦ 5968 - narrow pipe, AES based, 512-bit is a bit too slow, needs tuning down
sha2* ¦ 5968 - narrow pipe, vulnerable to length extension attacks
spectral_hash ¦ 6480 - narrow pipe, AES based, waaay too slow
simd ¦ 8528 - fast, WP-MD
blender ¦ 9040 - n/4+4 collisions? n/4+4 preimages?
dynamicsha_2 ¦ 9040 - narrow pipe, way too slow, needs tuning down, collisions?
shavite-3 ¦ 9040 - narrow pipe, AES based, too slow, needs tuning down
sarmal ¦ 9552 - narrow pipe, AES based, fast
chi ¦ 10064 - a bit too slow, needs tuning down, WP-MD
arirang ¦ 10576 - fast, WP-MD
bmw ¦ 11600 - very fast, WP-MD, too slow on 8-bit CPUs
blake ¦ 12112 - narrow pipe, fast
skein ¦ 12624 - very fast, narrow pipe, but includes wide pipe variants, WP-MD
lesamnta ¦ 13136 - narrow pipe, AES based, too slow, needs tuning down
lane ¦ 15696 - narrow pipe, AES based, 512-bit is way too slow, needs tuning down
tib3 ¦ 20816 - narrow pipe, very fast
essence ¦ 22352 - narrow pipe, 512-bit is a bit too slow, needs tuning down
twister ¦ 23888 - AES based, 252 collision resistance? 448 time + 64 memory preimage resistance?, fast
vortex ¦ 30544 - narrow pipe, AES based, way too slow, needs tuning down
sandstorm ¦ 38736 - narrow pipe, AES based, way too slow, needs tuning down
swifftx ¦ 42832 - AES based, the presenter scared the hell out of me, way too slow
edon-r ¦ 63312 - the fastest (too fast?), 512-bit is too slow on 8-bit CPUs, free start collisions? 2n/3 time + 2n/3 memory preimage resistance?, WP-MD
wamm ¦ 83792 - is out: conceded broken
ecoh ¦ 100176 - narrow pipe, huge reference code, waaay too slow, not random
sgail ¦ 128848 - AES based, huge reference code, way too slow, needs tuning down
hamsi ¦ 188416 - narrow pipe, huge reference code, too slow, needs tuning down
fsb ¦ 309072 - huge reference code, waaay too slow
crunch ¦ 1038 K - narrow pipe, insanely huge code, 512-bit is too slow, needs tuning down
* - not a part of the SHA-3 competition, included for comparison.
This is not a security or quality evaluation, but merely my personal opinion on which algorithms I consider to be most interesting. The higher the algorithm the simpler and the smaller is its reference implementation. While some attacked algorithms may be able to tune their parameters, narrow pipe designs cannot be changed, which is why they are further away as IMHO uninteresting. Although multiple collisions/preimages may not be much of a threat, IMHO herding attacks are. Also, while AES based designs are not bad, I consider them of less interest than the other more original designs - we paranoid cryptographers do not like to put all our eggs in one basket. “fast” means faster than SHA-2.
My conclusion: the most interesting submissions are EnRUPT (mine) and Keccak (i find small fast stream hashes especially interesting), also JH, BMW, Edon-R, WP Skein, SIMD, Arirang and CHI.
Sean O’Neil
VEST Corporation