Questions tagged [xof]
An extendable-output function (XOF) is similar to a hash function, but uses the internal state to output a stream of bits instead of a fixed-length octet string.
27 questions
2
votes
1
answer
86
views
Is ParallelHash XOF (part of SHA-3) seekable? Does it serve to preserve the full (or most) entropy of a large input when generating the output?
There is ParallelHash, a derived function part of SHA-3.
It acts like an Extendable-output function (XOF) that can use multiple threads in multi-core CPUs.
I can generate an (maybe) infinite keystream ...
- 55
7
votes
3
answers
1k
views
XOFs suitable for 16-bit hardware
I'm working on a programming language that's intended to compile to retro hardware, and I want to add a PRNG to the specification. Ideally, this would be both standard (easy to find specifications for)...
- 261
1
vote
1
answer
180
views
Security implications of using larger output length for extendable output functions (XOF)
Could someone explain the security implication of using XOF functions for larger output length? I have seen a few algorithms using fixed 32 bytes output length for SHAKE256. Does this have anything to ...
1
vote
1
answer
125
views
Valid use of extendable output functions?
I'm paranoid about new storage devices, since it's a common scam to reprogram a device to lie and report a much larger capacity than it actually has.
I know that there are testing programs ...
- 113
1
vote
1
answer
155
views
Is it safe to derive a Falcon512 key pair from a XOF output?
I'm working on a program that requires multiple key pairs from multiple algorithms to be derived from a single 128-byte master seed. However, I couldn't find an implementation for Falcon512 that ...
- 59
2
votes
1
answer
491
views
SHAKE256 XOF: Absorb incrementally vs all at once
I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher.
I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
- 31
2
votes
2
answers
804
views
What is the difference between a seeded RNG and an XOF hash?
Suppose I have some ZK proofs that were turned non-interactive using Fiat-Shamir heuristic. So I need to generate the challenge value deterministically using some data shared between the prover and ...
- 299
2
votes
2
answers
273
views
Matrix parsing in Kyber
In the Kyber specification the parse function (algorithm 1 on page 6) takes as input a non-terminating byte stream. Although unlikely, an unlimited number of bytes ...
- 30.9k
0
votes
0
answers
30
views
Can salt and XOF be used to create a symmetric cipher? [duplicate]
I'm new to crypto, and I've got an idea and I want to get some feedback if it's even a right direction. Let's say that I create a symmetric cipher by using an XOF with a salt and a secret key.
...
- 101
1
vote
0
answers
92
views
Is the security of output of Skein when using arbitrary output size similar to that of SHAKE?
Let's suppose I have a 1MB high-resolution photo and I want to hash and create a 1536-bits key.
I know that I could just use SHAKE-256 as its a pre-enginered way for doing that.
There is also Skein ...
- 887
1
vote
1
answer
240
views
Should the cSHAKE customization string ever be attacker-controlled?
On first glance, the optional customization string for cSHAKE resembles the optional salt input to HKDF-Extract. Indeed, the Noise Protocol Framework initially uses a protocol identifier string as its ...
- 567
3
votes
1
answer
261
views
Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits
Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key.
I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
- 887
2
votes
0
answers
148
views
Exact security requirements for extendable output functions (XOF)?
In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as:
An extendable-output function (XOF) is a ...
- 357
2
votes
1
answer
248
views
Number of rounds for constant header size in common hashes and XOFs
We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$.
For Merkle-Damgård hashes, a simple ...
- 151k
2
votes
1
answer
501
views
Why XOFs are more convenient than Hash Functions in modeling Random Oracles
In this answer, it is mentioned that
Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd ...
- 50.2k