文档章节

BLAKE2 — fast secure hashing

openthings
 openthings
发布于 2018/10/22 15:34
字数 2108
阅读 29
收藏 0

BLAKE2 — fast secure hashing

SPECS  |  CODE  |  B2SUM  |  CONTACT  |  USERS  |  THIRD-PARTY SOFTWARE  |  CRYPTANALYSIS  |  FAQ

 

BLAKE2 is a cryptographic hash function faster than MD5, SHA-1, SHA-2, and SHA-3, yet is at least as secure as the latest standard SHA-3. BLAKE2 has been adopted by many projects due to its high speed, security, and simplicity.

BLAKE2 is specified in RFC 7693, and our code and test vectors are available on GitHub, licensed under CC0 (public domain-like). BLAKE2 is also described in the 2015 book The Hash Function BLAKE.

BLAKE2 comes in two flavors:

  • BLAKE2b (or just BLAKE2) is optimized for 64-bit platforms—including NEON-enabled ARMs—and produces digests of any size between 1 and 64 bytes
  • BLAKE2s is optimized for 8- to 32-bit platforms and produces digests of any size between 1 and 32 bytes

BLAKE2 includes the 4-way parallel BLAKE2bp and 8-way parallel BLAKE2sp designed for increased performance on multicore or SIMD CPUs. BLAKE2 offers these algorithms tuned to your specific requirements, such as keyed hashing (that is, MAC or PRF), hashing with a salt, updatable or incremental tree-hashing, or any combination thereof. These versions are specified in the BLAKE2 document.

BLAKE2 also includes the BLAKE2x variants, which can produce digests of arbitrary length. BLAKE2x is specified in a separate document.

BLAKE2 shines on 64-bit CPUs: on an Intel Core i5-6600 (Skylake microarchitecture, 3310MHz), BLAKE2b can process 1 gibibyte per second, or a speed rate of 3.08 cycles per byte.

The plot below shows how BLAKE2 outperforms MD5, SHA-1, SHA-2, and SHA-3 on a Skylake Intel CPU (speeds are for hashing using a single core; using multiple cores, BLAKE2 can be even faster):

Specifications

  • blake2.pdf is our original BLAKE2 documentation, which describes how we went from the SHA-3 finalist BLAKE to BLAKE2, how all the BLAKE2 versions work, and analyzes BLAKE2's performance and security.
  • RFC 7693 is an RFC edited by Markku-Juhani O. Saarinen that provides a complete specification of BLAKE2b and BLAKE2s
  • blake2x.pdf, the specification of BLAKE2X, versions of BLAKE2 to create hashes of any length up to 4 GiB and build XOFs, KDFs, and DRBGs (published to request comments, design not final yet)

b2sum

The b2sum utility is similar to the md5sum or shasum utilities but for BLAKE2. The archive b2sum-bin_20130305.zip provides fat binaries of b2sum for Linux and Windows, 32-bit and 64-bit.

Contact

BLAKE2 was designed by a team of experts in cryptanalysis, implementation, and cryptographic engineering:

BLAKE2 is based on the SHA-3 proposal BLAKE, designed by Jean-Philippe Aumasson, Luca Henzen, Willi Meier, and Raphael C.-W. Phan. BLAKE2, like BLAKE, relies on a core algorithm borrowed from the ChaCha stream cipher, designed by Daniel J. Bernstein. You may contact us on Twitter if 140 characters are enough and if a public discussion is okay. Otherwise, please email us to contact@blake2.net, which forwards to the four designers.

We created a mailing list for BLAKE2 discussions (security, performance, bug reports, etc.): to subscribe, please send an empty message to info-subscribe@blake2.net.

Users

Non-exhaustive list of systems using BLAKE2:

  • WolfSSL: WolfSSL includes BLAKE2b
  • OpenSSL: OpenSSL includes BLAKE2b and BLAKE2s
  • Wireguard: The Wireguard VPN uses BLAKE2s for hashing and as a MAC
  • Botan: The Botan library includes BLAKE2b
  • Crypto++: The Crypto++ library includes BLAKE2s and BLAKE2b
  • Noise: The Noise protocol (now used in WhatsApp) uses BLAKE2s and BLAKE2b
  • Cifra Extrema: Cifra Extrema products use several versions of BLAKE2 in its servers and satellite modules
  • Bouncy Castle: Includes BLAKE2b-160, BLAKE2b-256, BLAKE2b-384, and BLAKE2b-512
  • Peerio: BLAKE2s is used to generated IDs and for integrity checks
  • 8th: BLAKE2s is the default hash in the 8th cross-platform development system
  • librsync: BLAKE2b is the default hash un this popular remote delta-compression library
  • checksum: BLAKE2s is one of the three hash functions supported with MD5 and SHA-1
  • Password hashing schemes:
    • Argon2 (by Biryukov, Dinu, Khovratovich; PHC winner)
    • Catena (by Forler, Lucks, Wenzel; PHC candidate)
    • Lanarea (by Mubarak; PHC candidate)
    • Lyra and Lyra2 (by Simplicio Jr., Barreto, Almeida, Andrade; PHC candidate)
    • Neoscrypt (by Doering)
    • RIG (by Chang, Jati, Mishra, Sanadhya; PHC candidate)
    • TwoCats (by Cox; PHC candidate)
    • Yarn (by Capun; PHC candidate)
  • Crypto tools by catid:
    • Cymric ("portable secure random number generator")
    • Snowshoe ("portable, secure, fast elliptic curve math library")
    • Tabby ("strong, fast, and portable cryptographic signatures and handshakes")
  • Sodium: BLAKE2b is the default hash function of this cryptography library based on NaCl
  • Accumulus: BLAKE2s is used for producing unique keys of the data stored
  • Archivarius 3000: BLAKE2s is used for deduplication in this desktop search system
  • Phoronix Test Suite: BLAKE2s is one of the benchmark modules (see OpenBenchmarking)
  • WinRAR: BLAKE2sp is an optional checksum in the RAR 5.0 archive format
  • YACP: BLAKE2 is integrated in Yet Another Cygwin-Ports
  • CyaSSL: BLAKE2b is one of the hash functions supported in this lightweight SSL library
  • Insomni'hack 2013: BLAKE2b was the hash used to validate flags in this hacking contest (CTF)
  • Pcompress: BLAKE2b is the default checksum in this parallel compression and deduplication utility; BLAKE2bp is used in some cases

Third-party software

  • 2018 Jun 13: Nazar Mokrynskyi. blake2.wasm.
    Main result: WebAssembly version
     
  • 2018 Jun 4: Jack O'Connor. blake2_c.rs.
    Main result: safe Rust wrapper around the C implementation
     
  • 2016 Sep 25: dcposch. blakejs.
    Main result: pure JavaScript implementation of BLAKE2b and BLAKE2s
     
  • 2016 Aug 25: Minio Cloud Storage. blake2b-simd.
    Main result: fast hashing using pure Go implementation of BLAKE2b with SIMD instructions
     
  • 2016 Jan 31: Pol Le Garsmeur. java-blake2s.
    Main result: Java implementation of BLAKE2s
     
  • 2016 Jan 5: ScorexProject. scrypto.
    Main result: Scala library providing BLAKE2
     
  • 2015 Dec 5: John Galt. blake2.
    Main result: Haskell library providing BLAKE2
     
  • 2015 Nov 9: Cesar Eduardo Barros. blake2-rfc.
    Main result: pure Rust, with experimental SIMD support
     
  • 2015 Oct 31: Coda Hale. blake2.
    Main result: Go wrapper
     
  • 2015 Jun 9: Ivan Kozik. node-blake2.
    Main result: io.js bindings for BLAKE2b, BLAKE2s, BLAKE2bp, BLAKE2sp
     
  • 2015 Jan 30: Markku-Juhani O. Saarinen. blake2_mjosref.
    Main result: "A clean & simple implementation of BLAKE2b and BLAKE2s hash functions -- written while writing the RFC."
     
  • 2014 Aug 27: Michael Gehring. rust-blake2.
    Main result: Rust implementation of BLAKE2b and BLAKE2s
     
  • 2014 Aug 4: C. J. Silvero. avon.
    Main result: node bindings for BLAKE2b, BLAKE2s, BLAKE2bp, and BLAKE2Sp
     
  • 2014 Feb 14: Joubin Houshyar. Blake2b.
    Main result: Java implementation of BLAKE2b
     
  • 2013 Dec 16: Larry Bugbee. blake2_py.
    Main result: 100% Python implementation of BLAKE2b and BLAKE2s
     
  • 2013 May 10: Floodyberry. blake2b-opt.
    Main result: optimized C implementation of BLAKE2b for x86, SSE2, SSSE3, AVX, and XOP
     
  • 2013 Mar 27: Dmitry Chestnykh. pyblake2.
    Main result: Python module for BLAKE2b and BLAKE2s
     
  • 2013 February 9: Tasuku Suenaga. Digest-BLAKE2-0.01.
    Main result: Perl interface to BLAKE2
     
  • 2013 Feb 3: Dmitry Chestnykh. blake2-dart.
    Main result: Dart implementation of BLAKE2s
     
  • 2013 Jan 14: Corey Richardson. libblake2.
    Main result: shared and static libraries for BLAKE2b, BLAKE2s, BLAKE2bp, and BLAKE2sp
     
  • 2013 Jan 7: Ulrik Sverdrup. blake2-ppc-altivec.
    Main result: BLAKE2s for PowerPC Altivec
     
  • 2013 Jan 6: Takashi Seki. node-blake2.
    Main result: node bindings for BLAKE2b, BLAKE2s, BLAKE2bp, and BLAKE2Sp
     
  • 2013 Jan 3: Dmitry Chestnykh. b2sum in Go.
    Main result: b2sum binaries for OS X (amd64), Linux (amd64), and Windows (x86)
     
  • 2012 Dec 30: Kwon-Han Bae. python-blake2.
    Main result: Python module for BLAKE2b and BLAKE2s
     
  • 2012 Dec 29: Dmitry Chestnykh. blake2s-js.
    Main result: BLAKE2s in TypeScript/JavaScript
     
  • 2012 Dec 29: Dmitry Chestnykh. blake2s.
    Main result: BLAKE2s in Go
     
  • 2012 Dec 24: Craig Akimoto. php-blake2.
    Main result: PHP wrapper
     
  • 2012 Dec 22: Dmitry Chestnykh. b2sum.
    Main result: command line tool b2sum in Go
     
  • 2012 Dec 22: Dmitry Chestnykh. blake2b.
    Main result: BLAKE2b in Go
     

Cryptanalysis

FAQ

Q: Where are test vectors?

A: https://github.com/BLAKE2/BLAKE2/tree/master/testvectors

Q: How can I be sure the BLAKE2 is secure?

A: We have no proof that BLAKE2 is as secure as we claim, but there are good reasons to believe it: BLAKE2 relies on (essentially) the same core algorithm as BLAKE, which has been intensively analyzed since 2008 within the SHA-3 competition, and which was one of the 5 finalists. NIST's final report writes that BLAKE has a "very large security margin", and that the the cryptanalysis performed on it has "a great deal of depth". The best academic attack on BLAKE (and BLAKE2) works on a reduced version with 2.5 rounds, whereas BLAKE2b does 12 rounds, and BLAKE2s does 10 rounds. But even this attack is not practical: it only shows for example that with 2.5 rounds, the preimage security of BLAKE2b is downgraded from 512 bits to 481 bits, or that the collision security of BLAKE2s is downgraded from 128 bits to 112 bits (which is similar to the security of 2048-bit RSA).

Q: Why is BLAKE2 so fast?

A: BLAKE2 is fast in software because it exploits features of modern CPUs, namely instruction-level parallelism, SIMD instruction set extensions, and multiple cores. BLAKE2 also benefits from the optimization work performed during the SHA-3 competition (see for example this paper by two of the designers of BLAKE2).

Q: Why do you want BLAKE2 to be fast? Aren't fast hashes bad?

A: You want your hash function to be fast if you are using it to compute the secure hash of a large amount of data, such as in distributed filesystems (e.g. Tahoe-LAFS), cloud storage systems (e.g. OpenStack Swift), intrusion detection systems (e.g. Samhain), integrity-checking local filesystems (e.g. ZFS), peer-to-peer file-sharing tools (e.g. BitTorrent), or version control systems (e.g. git). You only want your hash function to be slow if you're using it to "stretch" user-supplied passwords, in which case see the next question.

Q: So I shouldn't use BLAKE2 for hashing user passwords?

A: You shouldn't use *any* general-purpose hash function for user passwords, not BLAKE2, and not MD5, SHA-1, SHA-256, or SHA-3. Instead you should use a password hashing function such as the PHC winner Argon2 with appropriate time and memory cost parameters, to mitigate the risk of bruteforce attacks—Argon2's core uses a variant of BLAKE2's permutation.

Q: BLAKE2bp gives different results from BLAKE2b. Is that normal?

A: Yes. BLAKE2bp is a different algorithm from BLAKE2b and BLAKE2sp is a different algorithm from BLAKE2s. Each algorithm produces a different hash value.

BLAKE2b and BLAKE2s are designed to be efficient on a single CPU core (BLAKE2b is more efficient on 64-bit CPUs and BLAKE2s is more efficient on 8-bit, 16-bit, or 32-bit CPUs). BLAKE2bp and BLAKE2sp are designed to be efficient on multicore or SIMD chips, by processing the input in parallel. This parallel approach results in different secure hash values from the single-core variants.

More generally, two instances of BLAKE2b or BLAKE2s with two distinct sets of parameters will produce different results. For example, BLAKE2b in some tree mode (say, with fanout 2) will produce different results than BLAKE2b in a modified tree mode (say, with fanout 3).

Q: Which should I use? BLAKE2b, BLAKE2s, BLAKE2bp, or BLAKE2sp?

A: A rule of thumb is that on 64-bit platforms the best choice is BLAKE2b, whereas on 32-bit (or smaller) platforms BLAKE2s is recommended. Or, you could try each of the four of them and see which one performs best on your deployment platform. If you do that, please write to us and let us know what you found.

Q: The BLAKE2 documentation only describes differences with the original BLAKE, where can I find a complete specification?

A: The RFC includes a complete specification of BLAKE2b and BLAKE2s (though not of the tree mode).

本文转载自:http://www.blake2.net/

共有 人打赏支持
openthings
粉丝 286
博文 1052
码字总数 574209
作品 1
东城
架构师
私信 提问
libsodium 1.0.6 发布,加密库

libsodium 是一个先进而且易用的加密库。主要用于加密、解密、签名和生成密码哈希等等。这是一个可移植的、跨编译器支持、可安装的,基于 NaCI 开发,提供一个兼容 API。 libsodium 1.0.6 发...

oschina
2015/11/02
1K
2
『学概念找员外』Blake2算法

概念科普 哈希算法:在互联网的世界中,每台服务器上面会有无数多个文件,视频、音乐、压缩包、照片等等各种东西,当然还用作加密和签名。这些东西跟我们人一样,每一个文件都需要一个名字。...

刘员外__
2018/07/31
0
0
Couchbase .NET SDK 2.0 Beta 发布

Couchbase .NET SDK 2.0 Beta 发布,此版本是完全重写的 SDK,非常适用于编写高伸缩性的互联网应用。 Couchbase .NET SDK 2.0 Beta 新特性如下: 新的文档 API,可以在 JSON 文档中执行 CRUD...

oschina
2014/09/18
1K
6
Why do hash functions use prime numbers?

In a previous post i pointed out how questions posted in reward based discussions sites likestackoverflow.com never gets answered satisfactorily. This post is a look at one such......

天天顺利
2016/03/10
12
0
聊聊jump consistent hash

序 本文主要简介一下jump Consistent hash。 jump consistent hash jump consistent hash是一致性哈希的一种实现,论文见A Fast, Minimal Memory, Consistent Hash Algorithm 经典的一致性哈...

xixicat
2017/11/11
0
0

没有更多内容

加载失败,请刷新页面

加载更多

漏洞防御与修复工作

漏洞管理工作是企业安全建设必不可少的一环,在风险管理工作中,漏洞管理能够防患于未然,企业对漏洞管理有着广泛的基础建设和实践经验。但随着攻防技术的发展,传统漏洞管理的安全技术和管理...

linuxprobe16
28分钟前
1
0
MicroPython技术及应用前景

1 Micropython技术是什么? MicroPython极精简高效的实现了Python3语言。它包含Python标准库的一小部分,能在单片机和受限环境中运行。 1.1 MicroPython发展 由剑桥大学的理论物理学家乔治....

bodasisiter
34分钟前
1
0
跟我学Spring Cloud(Finchley版)-13-通用方式使用Hystrix

本节详细讲解使用Hystrix的通用方式。 简介 Hystrix是由Netflix开源的一个延迟和容错库,用于隔离访问远程系统、服务或者第三方库,防止级联失败,从而提升系统的可用性与容错性。Hystrix主要...

周立_ITMuch
42分钟前
1
0
🛠️Hanjst/汉吉斯特更新加JavaScript运行时优化等

这是 Hanjst/汉吉斯特 发布以来的首个主要升级更新版本。这次的主要升级更新的内容包括移除HTML Comments注释行, 优化在 Hanjst include模板文件时的JavaScript运行时环境。 Hanjst 在设计和...

wadelau
今天
2
0
OSChina 周六乱弹 —— 舔狗是没有好下场的

Osc乱弹歌单(2019)请戳(这里) 【今日歌曲】 @我没有抓狂 :#今天听什么# #今天听这个# 分享 Nirvana 的歌曲《Smells Like Teen Spi...》 《Smells Like Teen Spi...》- Nirvana 手机党少...

小小编辑
今天
526
14

没有更多内容

加载失败,请刷新页面

加载更多

返回顶部
顶部