6

I am trying to understand how hashing algorithms works, specially SHA3-512. To see how it works I searched for codes in Google and came across with Hashlib. The code doesn't work as I don't have the Hashlib library (not sure what it should be called). How can I get that and is it the only way to apply SHA3-512 in C#?

Some basic things that I want to know,

  1. What is Hashlib?

  2. Is it a Library?

  3. Is the output result/work process/function of Hashlib and System.Security.Cryptography.HashAlgorithm same? If not, then what is the difference between them?

Edit: Sorry for removing few questions from the middle. As I feel they don't need to be shown here anymore.

2 Answers 2

8

Note: Updated 2017.

Hashlib

Hashlib is a library of hash implementations:

https://hashlib.codeplex.com/

It includes implementations of quite a few cryptographic and non-cryptographic hashes - both ones that are already supported by the .NET framework (in System.Security.Cryptography) and ones that aren't. You'll need it - or another external implementation - to support SHA-3.

Note, however, that Hashlib doesn't actually include SHA-3 in its final form - but rather, the way it looked before some adjustments were made to it. That means, its output will not be what you'd expect from SHA-3.

HashLib uses a different architecture than .NET's HashAlgorithm for its hash algorithms - the output is the same (for the same algorithm, e.g. SHA256), the usage isn't. But it has a wrapper/adapter that can make the workflow the same as for HashAlgorithm, for example:

IHash hash = HashFactory.Crypto.SHA3.CreateKeccak512();
HashAlgorithm hashAlgo = HashFactory.Wrappers.HashToHashAlgorithm(hash);
// Now hashAlgo can be used the same as any .NET HashAlgorithm, e.g.:

// Create byte input from string encoded as UTF-8
byte[] input = Encoding.UTF8.GetBytes("Hello Keccak!");

byte[] output = hashAlgo.ComputeHash(bytes);

But again, be aware that Keccak512 is not the same as SHA-3 - it won't give the same hash as an actual 512 bit SHA-3 implementation.

Actual implementations of the final SHA-3 in C# are still (2017) few and far between - the difference to Keccak as implemented in Hashlib is extremely minor, although it has major impact on the output, as would be the case for a hash algorithm - since Wikipedia no longer provides an example of the difference, here's one:

Keccak-512('abc') =
Keccak[1024]('abc', 512) =
    18 58 7d c2 ea 10 6b 9a 15 63 e3 2b 33 12 42 1c
    a1 64 c7 f1 f0 7b c9 22 a9 c8 3d 77 ce a3 a1 e5
    d0 c6 99 10 73 90 25 37 2d c1 4a c9 64 26 29 37
    95 40 c1 7e 2a 65 b1 9d 77 aa 51 1a 9d 00 bb 96

SHA3-512('abc') =
Keccak[1024]('abc' || 01, 512) =
    b7 51 85 0b 1a 57 16 8a 56 93 cd 92 4b 6b 09 6e
    08 f6 21 82 74 44 f7 0d 88 4f 5d 02 40 d2 71 2e
    10 e1 16 e9 19 2a f3 c9 1a 7e c5 76 47 e3 93 40
    57 34 0b 4c f4 08 d5 a5 65 92 f8 27 4e ec 53 f0

Keccak[c](M || s, d) means "Keccak with capacity c, message M, suffix bits s, and output size d."

This (from the Wikipedia article) is the only difference between "standard" Keccak (and Hashlib's implementation) and SHA-3 as it looks in the current spec:

For SHA3-n, an additional two bits 01 are appended to the message before padding.

Implementing it (by e.g. patching the Hashlib code) isn't trivial, though, without knowing how Hashlib works.

So, should you use SHA-3?

It depends on what you want it for - it's no good if you want compatibility with the finalized SHA-3 standard.

The whole Keccak family, independent of SHA-3, is a standard in itself - but NIST's tweaks for SHA-3 are still Keccak - just a specific subset of it (much like AES is a subset of Rijndael). When SHA-3 eventually shows up in - for example - the .NET framework itself, it will likely just be SHA-3 with the parameters NIST picked, rather than a generic Keccak with tweakable parameters.

SHA-512 (answer to a part of the question that has now been removed)

SHA-512 is SHA-2 512 bit - not the same as SHA-3 512. That said, to use it, you simply import System.Security.Cryptography - using in this case imports the namespace - making the classes inside the namespace available to your code.

After that, the workflow is the same as any other HashAlgorithm.

So, should I use SHA-2 or SHA-3 for hashing passwords?

Neither of them. Or at least neither on their own. And while a salt improves matters, that's not optimal security either. See How to securely hash passwords, specifically starting from:

A basic hash function, even if secure as a hash function, is not appropriate for password hashing

Sign up to request clarification or add additional context in comments.

5 Comments

Thanks for your answer. you mention, "or another external implementation - to support SHA-3." exactly what is this another external implementation? and I just downloaded the hashlib2.1 but it has errors.
" its output will not be what you'd expect from SHA-3." ---if this is the case then I should not use or try to use hashlib at all.
Thanks man! now all my confusion is gone. I am clear about SHA3-512 and Keccak-512. I'm doing a project on block cipher and wish to hash the password. Since SHA3-512 is still a draft so I should go with SHA2-512.
The SHA3-n, are they all draft?
One last thing (just to add some new doubts ;-) ) - about using SHA-3, SHA-2, or any hash algorithm for the purpose of hashing passwords, do have a look at this: security.stackexchange.com/questions/211/… (changed link to a more informative question/answer)
3

What is Hashlib?

Basically it's a library implementing many hashing algorithms.

Is it a Library?

Yes

Is the output result/work process/function of Hashlib and System.Security.Cryptography.HashAlgorithm same? If not, then what is the difference between them?

Yes.

Hashlib provides the HashLib.HashFactory.Wrappers which can be used to convert the implementation provided by hashlib to System.Security.Cryptography.HashAlgorithm

It can be used this way.

IHash hash = HashFactory.Crypto.CreateSHA256();
System.Security.Cryptography.HashAlgorithm algorith = HashLib.HashFactory.Wrappers.HashToHashAlgorithm(hash);

2 Comments

So, Basically 'Hashlib' gives its output to 'System.Security.Cryptography.HashAlgorithm'. Whats the benefit of doing this? I can easily use 'SHA512Managed()' class instead. Don't you agree?
HashLib doesn't "give its output" to anything. The code Justin (and I) provide simply lets you use HashLib algorithms with the same interface (as in methods and properties) as HashAlgorithm. The benefit of using HashLib is getting support for hash algorithms that aren't implemented in .NET itself. Plus, support on platforms with a reduced .NET framework, because HashLib also has its own implementations of all algorithms the full .NET framework provides. Yes, you can use SHA512Managed (or SHA512) if that's what you need - and it's supported on your target. But note that it's not SHA-3.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.