BLAKE is a
cryptographic hash function
A cryptographic hash function (CHF) is a hash algorithm (a map of an arbitrary binary string to a binary string with fixed size of n bits) that has special properties desirable for cryptography:
* the probability of a particular n-bit output re ...
based on
Daniel J. Bernstein
Daniel Julius Bernstein (sometimes known as djb; born October 29, 1971) is an American German mathematician, cryptologist, and computer scientist. He is a visiting professor at CASA at Ruhr University Bochum, as well as a research professor ...
's
ChaCha
Cha-Cha, Cha Cha, ChaCha or Chacha may refer to:
Music
*Cha-cha-cha (dance), a dance of Cuban origin
*Cha-cha-cha (music), a genre of Cuban music
* ''Cha Cha'' (album), a 1978 album by Herman Brood & His Wild Romance
* ''Cha Cha'' (soundtrack), t ...
stream cipher
stream cipher is a symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream ( keystream). In a stream cipher, each plaintext digit is encrypted one at a time with the corresponding digit of the keystrea ...
, but a permuted copy of the input block,
XOR
Exclusive or or exclusive disjunction is a logical operation that is true if and only if its arguments differ (one is true, the other is false).
It is symbolized by the prefix operator J and by the infix operators XOR ( or ), EOR, EXOR, , , ...
ed with round constants, is added before each ChaCha round. Like
SHA-2
SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compressi ...
, there are two variants differing in the
word
A word is a basic element of language that carries an objective or practical meaning, can be used on its own, and is uninterruptible. Despite the fact that language speakers often have an intuitive grasp of what a word is, there is no conse ...
size. ChaCha operates on a 4×4 array of words. BLAKE repeatedly combines an 8-word hash value with 16 message words, truncating the ChaCha result to obtain the next hash value. BLAKE-256 and BLAKE-224 use 32-bit words and produce digest sizes of 256 bits and 224 bits, respectively, while BLAKE-512 and BLAKE-384 use 64-bit words and produce digest sizes of 512 bits and 384 bits, respectively.
The
BLAKE2
BLAKE is a cryptographic hash function based on Daniel J. Bernstein's ChaCha stream cipher, but a permuted copy of the input block, XORed with round constants, is added before each ChaCha round. Like SHA-2, there are two variants differing in the ...
hash function, based on BLAKE, was announced in 2012. The
BLAKE3 hash function, based on BLAKE2, was announced in 2020.
History
BLAKE was submitted to the
NIST hash function competition
The NIST hash function competition was an open competition held by the US National Institute of Standards and Technology (NIST) to develop a new hash function called SHA-3 to complement the older SHA-1 and SHA-2. The competition was formally ann ...
by Jean-Philippe Aumasson, Luca Henzen, Willi Meier, and Raphael C.-W. Phan. In 2008, there were 51 entries. BLAKE made it to the final round consisting of five candidates but lost to ''Keccak'' in 2012, which was selected for the
SHA-3 algorithm.
Algorithm
Like
SHA-2
SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compressi ...
, BLAKE comes in two variants: one that uses 32-bit words, used for computing hashes up to 256 bits long, and one that uses 64-bit words, used for computing hashes up to 512 bits long. The core block transformation combines 16 words of input with 16 working variables, but only 8 words (256 or 512 bits) are preserved between blocks.
It uses a table of 16 constant words (the leading 512 or 1024 bits of the fractional part of
π), and a table of 10 16-element permutations:
σ
= 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
σ
= 14 10 4 8 9 15 13 6 1 12 0 2 11 7 5 3
σ
= 11 8 12 0 5 2 15 13 10 14 3 6 7 1 9 4
σ
= 7 9 3 1 13 12 11 14 2 6 5 10 4 0 15 8
σ
= 9 0 5 7 2 4 10 15 14 1 11 12 6 8 3 13
σ
= 2 12 6 10 0 11 8 3 4 13 7 5 15 14 1 9
σ
= 12 5 1 15 14 13 4 10 0 7 6 3 9 2 8 11
σ
= 13 11 7 14 12 1 3 9 5 0 15 4 8 6 2 10
σ
= 6 15 14 9 11 3 0 8 12 2 13 7 1 4 10 5
σ
= 10 2 8 4 7 6 1 5 15 11 9 14 3 12 13 0
The core operation, equivalent to ChaCha's quarter round, operates on a 4-word column or diagonal
a b c d, which is combined with 2 words of message
m[] and two constant words
n[]. It is performed 8 times per full round:
j ← σ[r%10][2×i]
// Index computations
k ← σ[r%10][2×i+1]
a ← a + b + (m
⊕ n
// Step 1 (with input)
d ← (d ⊕ a) >>> 16
c ← c + d
// Step 2 (no input)
b ← (b ⊕ c) >>> 12
a ← a + b + (m
⊕ n
// Step 3 (with input)
d ← (d ⊕ a) >>> 8
c ← c + d
// Step 4 (no input)
b ← (b ⊕ c) >>> 7
In the above,
r is the round number (0–13), and
i varies from 0 to 7.
The differences from the ChaCha quarter-round function are:
* The addition of the message words has been added.
* The rotation directions have been reversed.
"BLAKE reuses the permutation of the ChaCha stream cipher with rotations done in the opposite directions. Some have suspected an advanced optimization, but in fact it originates from a typo in the original BLAKE specifications", Jean-Philippe Aumasson explains in his "Crypto Dictionary".
The 64-bit version (which does not exist in ChaCha) is identical, but the rotation amounts are 32, 25, 16 and 11, respectively, and the number of rounds is increased to 16.
Tweaks
Throughout the NIST hash function competition, entrants are permitted to "tweak" their algorithms to address issues that are discovered. Changes that have been made to BLAKE are: the number of rounds was increased from 10/14 to 14/16. This is to be more conservative about security while still being fast.
Example digests
Hash values of an empty string:
=
7dc5313b1c04512a174bd6503b89607aecbee0903d40a8a569c94eed
=
716f6e863f744b9ac22c97ec7b76ea5f5908bc5b2f67c61510bfc4751384ea7a
=
c6cbd89c926ab525c242e6621f2f5fa73aa4afe3d9e24aed727faaadd6af38b620bdb623dd2b4788b1c8086984af8706
=
a8cfbbd73726062df0c6864dda65defe58ef0cc52a5625090fa17601e1eecd1b628e94f396ae402a00acc9eab77b4d4c2e852aaaa25a636d80af3fc7913ef5b8
Changing a single bit causes each bit in the output to change with 50% probability, demonstrating an
avalanche effect
In cryptography, the avalanche effect is the desirable property of cryptographic algorithms, typically block ciphers and cryptographic hash functions, wherein if an input is changed slightly (for example, flipping a single bit), the output changes ...
:
=
1f7e26f63b6ad25a0896fd978fd050a1766391d2fd0471a77afb975e5034b7ad2d9ccf8dfb47abbbe656e1b82fbc634ba42ce186e8dc5e1ce09a885d41f43451
=
a701c2a1f9baabd8b1db6b75aee096900276f0b86dc15d247ecc03937b370324a16a4ffc0c3a85cd63229cfa15c15f4ba6d46ae2e849ed6335e9ff43b764198a
BLAKE2
BLAKE2 is a cryptographic hash function based on BLAKE, created by Jean-Philippe Aumasson, Samuel Neves,
Zooko Wilcox-O'Hearn
Zooko Wilcox-O'Hearn (born Bryce Wilcox; 13 May 1974 in Phoenix, Arizona), is an American Colorado-based computer security specialist, self-proclaimed cypherpunk, and CEO of the Electric Coin Company (ECC), a for-profit company leading the develo ...
, and Christian Winnerlein. The design goal was to replace the widely used, but broken,
MD5 and
SHA-1
In cryptography, SHA-1 (Secure Hash Algorithm 1) is a cryptographically broken but still widely used hash function which takes an input and produces a 160-bit (20-byte) hash value known as a message digest – typically rendered as 40 hexadecim ...
algorithms in applications requiring high performance in software. BLAKE2 was announced on December 21, 2012. A
reference implementation
In the software development process, a reference implementation (or, less frequently, sample implementation or model implementation) is a program that implements all requirements from a corresponding specification. The reference implementation o ...
is available under
CC0, the
OpenSSL License, and the
Apache License 2.0.
BLAKE2b is faster than MD5, SHA-1, SHA-2, and SHA-3, on 64-bit x86-64 and ARM architectures.
BLAKE2 provides better security than SHA-2 and similar to that of SHA-3: immunity to
length extension, indifferentiability from a random oracle, etc.
BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).
BLAKE2 supports keying, salting, personalization, and hash tree modes, and can output digests from 1 up to 64 bytes for BLAKE2b, or up to 32 bytes for BLAKE2s. There are also parallel versions designed for increased performance on
multi-core processor
A multi-core processor is a microprocessor on a single integrated circuit with two or more separate processing units, called cores, each of which reads and executes program instructions. The instructions are ordinary CPU instructions (such a ...
s; BLAKE2bp (4-way parallel) and BLAKE2sp (8-way parallel).
BLAKE2X is a family of extensible-output functions (XOFs). Whereas BLAKE2 is limited to 64-byte digests, BLAKE2X allows for digests of up to 256 GiB. BLAKE2X is itself not an instance of a hash function, and must be based on an actual BLAKE2 instance. An example of a BLAKE2X instance could be BLAKE2Xb16MiB, which would be a BLAKE2X version based on BLAKE2b producing 16,777,216-byte digests (or exactly 16
MiB, hence the name of such an instance).
BLAKE2b and BLAKE2s are specified in
RFC 7693. Optional features using the parameter block (salting, personalized hashes, tree hashing, et cetera), are not specified, and thus neither is support for BLAKE2bp, BLAKE2sp, or BLAKE2X.
BLAKE2sp is the BLAKE2 version used by
7zip
7-Zip is a free and open-source file archiver, a utility used to place groups of files within compressed containers known as "archives". It is developed by Igor Pavlov and was first released in 1999. 7-Zip has its own archive format called 7z, ...
file compressor signature in context menu "CRC SHA"
Initialization vector
BLAKE2b uses an initialization vector that is the same as the IV used by SHA-512. These values are
transparently obtained by taking the first 64 bits of the fractional parts of the positive square roots of the first eight prime numbers.
IV
0 = 0x6a09e667f3bcc908
// Frac(sqrt(2))
IV
1 = 0xbb67ae8584caa73b
// Frac(sqrt(3))
IV
2 = 0x3c6ef372fe94f82b
// Frac(sqrt(5))
IV
3 = 0xa54ff53a5f1d36f1
// Frac(sqrt(7))
IV
4 = 0x510e527fade682d1
// Frac(sqrt(11))
IV
5 = 0x9b05688c2b3e6c1f
// Frac(sqrt(13))
IV
6 = 0x1f83d9abfb41bd6b
// Frac(sqrt(17))
IV
7 = 0x5be0cd19137e2179
// Frac(sqrt(19))
BLAKE2b algorithm
Pseudocode
In computer science, pseudocode is a plain language description of the steps in an algorithm or another system. Pseudocode often uses structural conventions of a normal programming language, but is intended for human reading rather than machine re ...
for the BLAKE2b algorithm. The BLAKE2b algorithm uses 8-byte (UInt64) words, and 128-byte chunks.
Algorithm BLAKE2b
Input:
M
''Message to be hashed''
cbMessageLen: Number, (0..2
128)
''Length of the message in bytes''
Key
''Optional 0..64 byte key''
cbKeyLen: Number, (0..64)
''Length of optional key in bytes''
cbHashLen: Number, (1..64)
''Desired hash length in bytes''
Output:
Hash
''Hash of cbHashLen bytes''
''Initialize State vector h with IV''
h
0..7 ← IV
0..7
''Mix key size (cbKeyLen) and desired hash length (cbHashLen) into h0''
h
0 ← h
0 xor 0x0101kknn
''where kk is Key Length (in bytes)''
nn ''is Desired Hash Length (in bytes)''
''Each time we Compress we record how many bytes have been compressed''
cBytesCompressed ← 0
cBytesRemaining ← cbMessageLen
''If there was a key supplied (i.e. cbKeyLen > 0)''
''then pad with trailing zeros to make it 128-bytes (i.e. 16 words) ''
''and prepend it to the message M''
if (cbKeyLen > 0)
then
M ← Pad(Key, 128) , , M
cBytesRemaining ← cBytesRemaining + 128
end if
''Compress whole 128-byte chunks of the message, except the last chunk''
while (cBytesRemaining > 128)
do
chunk ← get next 128 bytes of message M
cBytesCompressed ← cBytesCompressed + 128
''increase count of bytes that have been compressed''
cBytesRemaining ← cBytesRemaining - 128
''decrease count of bytes in M remaining to be processed''
h ← Compress(h, chunk, cBytesCompressed, false)
''false ⇒ this is not the last chunk''
end while
''Compress the final bytes from M''
chunk ← get next 128 bytes of message M
''We will get cBytesRemaining bytes (i.e. 0..128 bytes)''
cBytesCompressed ← cBytesCompressed+cBytesRemaining
''The actual number of bytes leftover in M''
chunk ← Pad(chunk, 128)
''If M was empty, then we will still compress a final chunk of zeros''
h ← Compress(h, chunk, cBytesCompressed, true)
''true ⇒ this is the last chunk''
Result ← first cbHashLen bytes of little endian state vector h
End Algorithm BLAKE2b
Compress
The Compress function takes a full 128-byte chunk of the input message and mixes it into the ongoing state array:
Function Compress
Input:
h
''Persistent state vector''
chunk
''128-byte (16 double word) chunk of message to compress''
t: Number, 0..2
128 ''Count of bytes that have been fed into the Compression''
IsLastBlock: Boolean
''Indicates if this is the final round of compression''
Output:
h
''Updated persistent state vector''
''Setup local work vector V''
V
0..7 ← h
0..7 ''First eight items are copied from persistent state vector h''
V
8..15 ← IV
0..7 ''Remaining eight items are initialized from the IV''
''Mix the 128-bit counter t into V''12:V13
V
12 ← V
12 xor Lo(t)
''Lo 64-bits of UInt128 t''
V
13 ← V
13 xor Hi(t)
''Hi 64-bits of UInt128 t''
''If this is the last block then invert all the bits in V14''
if IsLastBlock
then
V
14 ← V
14 xor 0xFFFFFFFFFFFFFFFF
''Treat each 128-byte message chunk as sixteen 8-byte (64-bit) words m''
m
0..15 ← chunk
''Twelve rounds of cryptographic message mixing''
for i
from 0
to 11
do
''Select message mixing schedule for this round.''
''BLAKE2b uses 12 rounds, while SIGMA has only 10 entries.''
S
0..15 ← SIGMA
mod_10.html" ;"title=" mod 10"> mod 10 ''Rounds 10 and 11 use SIGMA and SIGMA respectively''
Mix(V
0, V
4, V
8, V
12, m
0 m
1
Mix(V
1, V
5, V
9, V
13, m
2 m
3
Mix(V
2, V
6, V
10, V
14, m
4 m
5
Mix(V
3, V
7, V
11, V
15, m
6 m
7
Mix(V
0, V
5, V
10, V
15, m
8 m
9
Mix(V
1, V
6, V
11, V
12, m
10 m
11
Mix(V
2, V
7, V
8, V
13, m
12 m
13
Mix(V
3, V
4, V
9, V
14, m
14 m
15
end for
''Mix the upper and lower halves of V into ongoing state vector h''
h
0..7 ← h
0..7 xor V
0..7
h
0..7 ← h
0..7 xor V
8..15
Result ← h
End Function Compress
Mix
The Mix function is called by the Compress function, and mixes two 8-byte words from the message into the hash state. In most implementations this function would be written inline, or as an inlined function.
Function Mix
Inputs:
V
a, V
b, V
c, V
d ''four 8-byte word entries from the work vector V''
x, y
''two 8-byte word entries from padded message m''
Output:
V
a, V
b, V
c, V
d ''the modified versions of Va, Vb, Vc, Vd''
V
a ← V
a + V
b + x
''with input''
V
d ← (V
d xor V
a)
rotateright 32
V
c ← V
c + V
d ''no input''
V
b ← (V
b xor V
c)
rotateright 24
V
a ← V
a + V
b + y
''with input''
V
d ← (V
d xor V
a)
rotateright 16
V
c ← V
c + V
d ''no input''
V
b ← (V
b xor V
c)
rotateright 63
Result ← V
a, V
b, V
c, V
d
End Function Mix
Example digests
Hash values of an empty string:
=
1fa1291e65248b37b3433475b2a0dd63d54a11ecc4e3e034e7bc1ef4
=
69217a3079908094e11121d042354a7c1f55b6482ca1a51e1b250dfd1ed0eef9
=
b32811423377f52d7862286ee1a72ee540524380fda1724a6f25d7978c6fd3244a6caf0498812673c5e05ef583825100
=
786a02f742015903c6c6fd852552d272912f4740e15847618a86e217f71f5419d25e1031afee585313896444934eb04b903a685b1448b755d56f701afe9be2ce
Changing a single bit causes each bit in the output to change with 50% probability, demonstrating an
avalanche effect
In cryptography, the avalanche effect is the desirable property of cryptographic algorithms, typically block ciphers and cryptographic hash functions, wherein if an input is changed slightly (for example, flipping a single bit), the output changes ...
:
=
a8add4bdddfd93e4877d2746e62817b116364a1fa7bc148d95090bc7333b3673f82401cf7aa2e4cb1ecd90296e3f14cb5413f8ed77be73045b13914cdcd6a918
=
ab6b007747d8068c02e25a6008db8a77c218d94f3b40d2291a7dc8a62090a744c082ea27af01521a102e42f480a31e9844053f456b4b41e8aa78bbe5c12957bb
Users of BLAKE2
*
Argon2
Argon2 is a key derivation function that was selected as the winner of the 2015 Password Hashing Competition. It was designed by Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich from the University of Luxembourg. The reference implementation ...
, the winner of the
Password Hashing Competition
The Password Hashing Competition was an open competition announced in 2013 to select one or more password hash functions that can be recognized as a recommended standard. It was modeled after the successful Advanced Encryption Standard process an ...
, uses BLAKE2b
*
Chef
A chef is a trained professional cook and tradesman who is proficient in all aspects of food preparation, often focusing on a particular cuisine. The word "chef" is derived from the term ''chef de cuisine'' (), the director or head of a kit ...
's Habitat deployment system uses BLAKE2b for package signing
*
FreeBSD Ports
The FreeBSD Ports collection is a package management system for the FreeBSD operating system, providing an easy and consistent way of installing software packages. As of February 2020, there are over 38,487 ports available in the collection. It has ...
package management tool uses BLAKE2b
*
GNU Core Utilities
The GNU Core Utilities or coreutils is a package of GNU software containing implementations for many of the basic tools, such as cat, ls, and rm, which are used on Unix-like operating systems.
In September 2002, the ''GNU coreutils'' were ...
implements BLAKE2b in its b2sum command
*
IPFS allows use of BLAKE2b for tree hashing
*
librsync
rsync is a utility for efficiently transferring and synchronizing files between a computer and a storage drive and across networked computers by comparing the modification times and sizes of files. It is commonly found on Unix-like operati ...
uses BLAKE2b
*
Noise (cryptographic protocol), which is used in
WhatsApp
WhatsApp (also called WhatsApp Messenger) is an internationally available freeware, cross-platform, centralized instant messaging (IM) and voice-over-IP (VoIP) service owned by American company Meta Platforms (formerly Facebook). It allows u ...
includes BLAKE2 as an option.
*
RAR file archive format version 5 supports an optional 256-bit BLAKE2sp file checksum instead of the default 32-bit
CRC32
A cyclic redundancy check (CRC) is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to digital data. Blocks of data entering these systems get a short ''check value'' attached, based on ...
; it was implemented in
WinRAR
WinRAR is a trialware file archiver utility for Windows, developed by Eugene Roshal of win.rar GmbH. It can create and view archives in RAR or ZIP file formats, and unpack numerous archive file formats. To enable the user to test the integrity ...
v5+
*
7-Zip
7-Zip is a free and open-source file archiver, a utility used to place groups of files within compressed containers known as "archives". It is developed by Igor Pavlov and was first released in 1999. 7-Zip has its own archive format called 7z, ...
can generate the BLAKE2sp signature for each file in the Explorer shell via "CRC SHA" context menu, and choosing '*'
*
rmlint uses BLAKE2b for duplicate file detection
*
WireGuard uses BLAKE2s for hashing
*
Zcash, a cryptocurrency, uses BLAKE2b in the
Equihash proof of work
Proof of work (PoW) is a form of cryptographic proof in which one party (the ''prover'') proves to others (the ''verifiers'') that a certain amount of a specific computational effort has been expended. Verifiers can subsequently confirm this expe ...
, and as a
key derivation function
In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function (which typically uses a crypt ...
*
NANO, a cryptocurrency, uses BLAKE2b in the proof of work, for hashing digital signatures and as a
key derivation function
In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function (which typically uses a crypt ...
*
Polkadot, a multi-chain blockchain uses BLAKE2b as its hashing algorithm.
*
PCI Vault, uses BLAKE2b as its hashing algorithm for the purpose of PCI compliant PCD tokenization.
*
Ergo, a cryptocurrency, uses BLAKE2b256 as a subroutine of its hashing algorithm called Autolykos.
*
Linux kernel
The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel. It was originally authored in 1991 by Linus Torvalds for his i386-based PC, and it was soon adopted as the kernel for the GNU ...
, version 5.17 replaced SHA-1 with BLAKE2s for hashing the
entropy pool
In computing, a hardware random number generator (HRNG) or true random number generator (TRNG) is a device that generates random numbers from a physical process, rather than by means of an algorithm. Such devices are often based on microscop ...
in the
random number generator
Random number generation is a process by which, often by means of a random number generator (RNG), a sequence of numbers or symbols that cannot be reasonably predicted better than by random chance is generated. This means that the particular outc ...
.
*
Open Network for Digital Commerce, a Government of India initiative, uses BLAKE-512 to sign API requests.
Implementations
In addition to the reference implementation,
the following cryptography libraries provide implementations of BLAKE2:
*
Botan
*
Bouncy Castle
*
Crypto++
Crypto++ (also known as CryptoPP, libcrypto++, and libcryptopp) is a free and open-source C++ class library of cryptographic algorithms and schemes written by Wei Dai. Crypto++ has been widely used in academia, student projects, open-source, and n ...
*
Libgcrypt
*
libsodium
NaCl (pronounced "salt") is an abbreviation for "Networking and Cryptography library", a public domain "...high-speed software library for network communication, encryption, decryption, signatures, etc".
NaCl was created by the mathematician and ...
*
OpenSSL
OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HTT ...
*
wolfSSL
wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers. It is an open source implementation of TLS (SSL 3.0, TLS 1.0, 1.1, 1.2, 1.3, and DTLS 1.0, 1.2, and 1.3) written in the C programming langu ...
BLAKE3
BLAKE3 is a cryptographic hash function based on Bao and BLAKE2, created by Jack O'Connor, Jean-Philippe Aumasson, Samuel Neves, and
Zooko Wilcox-O'Hearn
Zooko Wilcox-O'Hearn (born Bryce Wilcox; 13 May 1974 in Phoenix, Arizona), is an American Colorado-based computer security specialist, self-proclaimed cypherpunk, and CEO of the Electric Coin Company (ECC), a for-profit company leading the develo ...
. It was announced on January 9, 2020, at
Real World Crypto.
BLAKE3 is a single algorithm with many desirable features (parallelism, XOF, KDF, PRF and MAC), in contrast to BLAKE and BLAKE2, which are algorithm families with multiple variants. BLAKE3 has a
binary tree
In computer science, a binary tree is a k-ary k = 2 tree data structure in which each node has at most two children, which are referred to as the ' and the '. A recursive definition using just set theory notions is that a (non-empty) binary tr ...
structure, so it supports a practically unlimited degree of parallelism (both SIMD and multithreading) given long enough input. The official
Rust
Rust is an iron oxide, a usually reddish-brown oxide formed by the reaction of iron and oxygen in the catalytic presence of water or air moisture. Rust consists of hydrous iron(III) oxides (Fe2O3·nH2O) and iron(III) oxide-hydroxide (FeO(OH) ...
and
C implementations
are
dual-licensed as public domain (
CC0) and the
Apache License.
BLAKE3 is designed to be as fast as possible. It is consistently a few times faster than BLAKE2. The BLAKE3 compression function is closely based on that of BLAKE2s, with the biggest difference being that the number of rounds is reduced from 10 to 7, a change based on the assumption that current cryptography is too conservative.
In addition to providing parallelism, the Merkle tree format also allows for verified streaming (on-the-fly verifying) and incremental updates.
References
External links
The BLAKE web siteThe BLAKE2 web siteThe BLAKE3 web site
{{DEFAULTSORT:Blake
Extendable-output functions
NIST hash function competition
Public-domain software with source code
Checksum algorithms