Comparison of cryptographic hash functions

| 2008

| Jean-Philippe Aumasson
Luca Henzen
Willi Meier
Raphael C.-W. Phan

| ChaCha20

| [https://131002.net/blake/ Website]
[https://web.archive.org/web/20201001184633/http://131002.net/blake/blake.pdf Specification]

| 2012

| Jean-Philippe Aumasson
Samuel Neves
Zooko Wilcox-O'Hearn
Christian Winnerlein

| BLAKE

| [https://blake2.net/ Website]
[https://blake2.net/blake2.pdf Specification]
{{IETF RFC|7693}}

| 2020

| Jack O'Connor
Jean-Philippe Aumasson
Samuel Neves
Zooko Wilcox-O'Hearn

| BLAKE2

| [https://github.com/BLAKE3-team/BLAKE3 Website]
[https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf Specification]

| 1994

| FAPSI and VNIIstandart

| GOST 28147-89

| {{IETF RFC|5831}}

| 1992

| Yuliang Zheng
Josef Pieprzyk
Jennifer Seberry

|

| [https://web.archive.org/web/20150111210116/http://labs.calyptix.com/haval.php Website]
[https://web.archive.org/web/20140411060613/http://labs.calyptix.com/files/haval-paper.pdf Specification]

| 2016

| Guido Bertoni
Joan Daemen
Michaël Peeters
Gilles Van Assche

| Keccak

| [https://keccak.team/kangarootwelve.html Website]
[https://keccak.team/files/KangarooTwelve.pdf Specification]

| 1989

| rowspan="4" | Ronald Rivest

|

| {{IETF RFC|1319}}

| 1990

|

| {{IETF RFC|1320}}

| 1992

| MD4

| {{IETF RFC|1321}}

| 2008

|

| [https://groups.csail.mit.edu/cis/md6/ Website]
[https://groups.csail.mit.edu/cis/md6/docs/2009-04-15-md6-report.pdf Specification]

| 1992

| The RIPE Consortium{{cite conference|first1=Hans|last1=Dobbertin|author-link1=Hans Dobbertin|first2=Antoon|last2=Bosselaers|first3=Bart|last3=Preneel|author-link3=Bart Preneel|title=RIPEMD-160: A strengthened version of RIPEMD|conference=Fast Software Encryption. Third International Workshop|location=Cambridge, UK|date=21–23 February 1996|pages=71–82|url=https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf|doi=10.1007/3-540-60865-6_44|doi-access=free}}

| MD4

|

| 1996

| Hans Dobbertin
Antoon Bosselaers
Bart Preneel

| RIPEMD

| [https://homes.esat.kuleuven.be/~bosselae/ripemd160.html Website]
[https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf Specification]

| 1993

| rowspan="4"|NSA

|

| [https://web.archive.org/web/20090130063617/http://w2.eff.org/Privacy/Digital_signature/?f=fips_sha_shs.info.txt SHA-0]

| 1995

| SHA-0

| rowspan="3" | [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf Specification]

| 2002

| rowspan="2"|

| 2004

| 2008

| Guido Bertoni
Joan Daemen
Michaël Peeters
Gilles Van Assche

| RadioGatún

| [https://keccak.team/ Website]
[https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf Specification]

| 2012

| FSB, InfoTeCS JSC

|

| {{IETF RFC|6986}}

| 1995

| Ross Anderson
Eli Biham

|

| [https://www.cs.technion.ac.il/~biham/Reports/Tiger/ Website]
[https://www.cs.technion.ac.il/~biham/Reports/Tiger/tiger/node3.html Specification]

| 2004

| Vincent Rijmen
Paulo Barreto

|

| [https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html Website]

| 512

| 512

| 1024

| 128{{notetag|The size of BLAKE2b's message length counter is 128-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 128-bit length size would suggest (one byte equaling eight bits). A length size of 131-bit is the comparable length size ($8\; \backslash times\; 2^\{128\}\; =\; 2^\{131\}$).}}

| 64

| 12

| 256

| 256

| 512

| 64{{notetag|The size of BLAKE2s's message length counter is 64-bit, but it counts message length in bytes, not in bits like the other hash functions in the comparison. It can hence handle eight times longer messages than a 64-bit length size would suggest (one byte equaling eight bits). A length size of 67-bit is the comparable length size ($8\; \backslash times\; 2^\{64\}\; =\; 2^\{67\}$).}}

| 32

| 10

| Unlimited{{notetag|It's technically 2⁶⁴ bytes which equals 2⁶⁷ bitshttps://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf page 8}}

| 256{{notetag|The full BLAKE3 incremental state includes a chaining value stack up to 1728 bytes in size. However, the compression function itself does not access this stack. A smaller stack can also be used if the maximum input length is restricted.}}

| 512

| 64

| 32

| 7

| 256

| 256

| 256

| 256

| 32

| 32

| 256/224/192/160/128

| 256

| 1024

| 64

| 32

| 3/4/5

| 128

| 384

| 128

| –

| 32

| 18

| 128

| 128

| 512

| 64

| 32

| 3

| 128

| 128

| 512

| 64

| 32

| 64

| 256

| 8736

| 256

| –

| 32

| –

| Unlimited{{notetag|RadioGatún is an extendable-output function which means it has an output of unlimited size. The official test vectors are 256-bit hashes. RadioGatún claims to have the security level of a cryptographic sponge function 19 words in size, which means the 32-bit version has the security of a 304-bit hash when looking at preimage attacks, but the security of a 608-bit hash when looking at collision attacks. The 64-bit version, likewise, has the security of a 608-bit or 1216-bit hash. For the purposes of determining how vulnerable RadioGatún is to length extension attacks, only two words of its 58-word state are output between hash compression operations.}}

| 58 words

| 19 words{{notetag|RadioGatún is not a Merkle–Damgård construction and, as such, does not have a block size. Its belt is 39 words in size; its mill, which is the closest thing RadioGatún has to a "block", is 19 words in size.}}

| –

| 1–64{{notetag|Only the 32-bit and 64-bit versions of RadioGatún have official test vectors}}

| 18{{notetag|The 18 blank rounds are only applied once in RadioGatún, between the end of the input mapping stage and before the generation of output bits}}

| 128

| 128

| 512

| 64

| 32

| 48

| 128/256

| 128/256

| 512

| 64

| 32

| 64

| 160

| 160

| 512

| 64

| 32

| 80

| 320

| 320

| 512

| 64

| 32

| 80

| 160

| 160

| 512

| 64

| 32

| 80

| 160

| 160

| 512

| 64

| 32

| 80

| 224/256

| 256

| 512

| 64

| 32

| 64

| 384/512/224/256

| 512

| 1024

| 128

| 64

| 80

| 224/256/384/512{{notetag|Although the underlying algorithm Keccak has arbitrary hash lengths, the NIST specified 224, 256, 384 and 512 bits output as valid modes for SHA-3.}}

| 1600

| 1600 - 2*bits

| –{{notetag|Implementation dependent; as per section 7, second paragraph from the bottom of page 22, of FIPS PUB 202.}}

| 64

| 24

| 224

| 1600

| 1152

| –

| 64

| 24

| 256

| 1600

| 1088

| –

| 64

| 24

| 384

| 1600

| 832

| –

| 64

| 24

| 512

| 1600

| 576

| –

| 64

| 24

| 192/160/128

| 192

| 512

| 64

| 64

| 24

| 512

| 512

| 512

| 256

| 8

| 10

| 32

| colspan="3" | {{nowrap|×8 {{=}} 256}}

| {{nowrap|×8 {{=}} 256}}

| 32

| 4

| A B L S

| Little

| rowspan="15" | 32

| {{nowrap|×4 {{=}} 128}}

| colspan="2" rowspan="15" | {{nowrap|×8 {{=}} 256}}

| rowspan="15" | {{nowrap|×32 {{=}} 1,024}}

| rowspan="15" | 64

| rowspan="5" | {{nowrap|32 × 3 {{=}} 96}}

| rowspan="15" | A B S

| rowspan="15" | Little

| {{nowrap|×5 {{=}} 160}}

| {{nowrap|×6 {{=}} 192}}

| {{nowrap|×7 {{=}} 224}}

| {{nowrap|×8 {{=}} 256}}

| {{nowrap|×4 {{=}} 128}}

| rowspan="5" | {{nowrap|32 × 4 {{=}} 128}}

| {{nowrap|×5 {{=}} 160}}

| {{nowrap|×6 {{=}} 192}}

| {{nowrap|×7 {{=}} 224}}

| {{nowrap|×8 {{=}} 256}}

| {{nowrap|×4 {{=}} 128}}

| rowspan="5" | {{nowrap|32 × 5 {{=}} 160}}

| {{nowrap|×5 {{=}} 160}}

| {{nowrap|×6 {{=}} 192}}

| {{nowrap|×7 {{=}} 224}}

| {{nowrap|×8 {{=}} 256}}

| 8

| {{nowrap|×16 {{=}} 128}}

| {{nowrap|×32 {{=}} 256}}

| {{nowrap|×48 {{=}} 384}}

| {{nowrap|×16 {{=}} 128}}

| None

| {{nowrap|48 × 18 {{=}} 864}}

| B

| N/A

| rowspan="2" | 32

| colspan="3" rowspan="2"| {{nowrap|×4 {{=}} 128}}

| rowspan="2" | {{nowrap|×16 {{=}} 512}}

| rowspan="2" | 64

| {{nowrap|16 × 3 {{=}} 48}}

| rowspan="2" | A B S

| rowspan="2" | Little

| {{nowrap|16 × 4 {{=}} 64}}

| rowspan="5" | 32

| colspan="2" rowspan="2" | {{nowrap|×4 {{=}} 128}}

| rowspan="3" | {{nowrap|×8 {{=}} 256}}

| rowspan="5" | {{nowrap|×16 {{=}} 512}}

| rowspan="5" | 64

| {{nowrap|16 × 3 {{=}} 48}}

| rowspan="5" | A B S

| rowspan="5" | Little

| rowspan="2" | {{nowrap|16 × 4 {{=}} 64}}

| colspan="2" | {{nowrap|×8 {{=}} 256}}

| colspan="2" | {{nowrap|×5 {{=}} 160}}

| rowspan="2" | {{nowrap|×10 {{=}} 320}}

| rowspan="2" | {{nowrap|16 × 5 {{=}} 80}}

| colspan="2" | {{nowrap|×10 {{=}} 320}}

| rowspan="4" | 32

| colspan="3" rowspan="2" | {{nowrap|×5 {{=}} 160}}

| rowspan="4" | {{nowrap|×16 {{=}} 512}}

| rowspan="4" | 64

| rowspan="2" | {{nowrap|16 × 5 {{=}} 80}}

| rowspan="6" | A B S

| rowspan="6" | Big

| {{nowrap|×8 {{=}} 256}}

| colspan="2" rowspan="2" | {{nowrap|×8 {{=}} 256}}

| rowspan="2" | {{nowrap|16 × 4 {{=}} 64}}

| {{nowrap|×7 {{=}} 224}}

| rowspan="2" | 64

| {{nowrap|×8 {{=}} 512}}

| colspan="2" rowspan="2" | {{nowrap|×8 {{=}} 512}}

| rowspan="2" | {{nowrap|×16 {{=}} 1024}}

| rowspan="2" | 128

| rowspan="2" | {{nowrap|16 × 5 {{=}} 80}}

| {{nowrap|×6 {{=}} 384}}

| rowspan="3" | 64

| {{nowrap|×3 {{=}} 192}}

| colspan="2" rowspan="3" | {{nowrap|×3 {{=}} 192}}

| rowspan="3" | {{nowrap|×8 {{=}} 512}}

| rowspan="3" | 64

| rowspan="3" | {{nowrap|8 × 3 {{=}} 24}}

| rowspan="3" | A B L S

| rowspan="3" | Not Specified

| ×2.5=160

| {{nowrap|×2 {{=}} 128}}