Add std.crypto.hash.sha3.{KT128,KT256} #25593
Conversation
|
Lazy copy/paste of the benchmarks from the parallel BLAKE3 PR: Apple M1AMD Zen4KT128 and KT256 are the fastest cryptographic hash functions for large inputs. However, tree hashing+threads can be pretty damaging to other applications in concurrent scenarios. |
|
Let's wait for #25592 to land. |
KT128 and KT256 are fast, secure cryptographic hash functions based on Keccak (SHA-3). They can be seen as the modern version of SHA-3, and evolution of SHAKE, with better performance. After the SHA-3 competition, the Keccak team proposed these variants in 2016, and the constructions underwent 8 years of public scrutiny before being standardized in October 2025 as RFC 9861. They uses a tree-hashing mode on top of TurboSHAKE, providing both high security and excellent performance, especially on large inputs. They support arbitrary-length output and optional customization strings. Hashing of very large inputs can be done using multiple threads, for high throughput. KT128 provides 128-bit security strength, equivalent to AES-128 and SHAKE128, which is sufficient for virtually all applications. KT256 provides 256-bit security strength. For small inputs, TurboSHAKE128 and TurboSHAKE256 (which KT128 and KT256 are based on) can be used instead as they have less overhead.
* master: fix typo in std.debug.ElfFile.loadSeparateDebugFile Revert "ci: stop building FreeBSD module tests on x86_64-linux" Io: fix some horrible data races and UAFs caused by `Condition` misuse
* master: Implement threaded BLAKE3 (ziglang#25587) std: Skip element comparisons if `mem.order` args point to same memory std.Target: bump vulkan max version to 1.4.331 std.Target: bump opencl/nvcl max version to 3.0.19 std.Target: bump cuda max version to 13.0.2 std.Target: bump amdhsa max version to 7.1.0 std.Target: bump wasi max version to 0.3.0 std.Target: bump dragonfly max version to 6.4.2 std.Target: bump linux max version to 6.17 std.Target: bump fuchsia max version to 28.0.0 std.Target: bump contiki max version to 5.1.0 test: remove some unsupported x86_64 darwin targets from llvm_targets std.os.windows: eliminate forwarder function in kernel32 (ziglang#25766)
|
These tests are failing randomly on aarch64. |
|
Maybe bf90825 fixes this? Do you have a CI job where this failure occurred? I ran it locally for 8 hours straight and didn’t see any failing tests. |
|
While the crashes appear to not be your fault (current working theory is a qemu bug triggered by the less common instructions required to use a very large stack frame), I believe the fix is just an all-around improvement. Suggested fix: --- a/lib/std/crypto/kangarootwelve.zig
+++ b/lib/std/crypto/kangarootwelve.zig
@@ -230,7 +230,7 @@ fn keccakP1600timesN(comptime N: usize, states: *[5][5]@Vector(N, u64)) void {
break :blk offsets;
};
- inline for (RC) |rc| {
+ for (&RC) |rc| {
// θ (theta)
var C: [5]@Vector(N, u64) = undefined;
inline for (0..5) |x| {Affect on stack frame size: Affect on runtime performance: ↓ aarch64 Debug: ↓ x86_64 ReleaseFast (within run-to-run variance): ↓ aarch64 ReleaseFast (within run-to-run variance): ↓ My analysis for why removing So far I have not seen this happen on CI, but I was able to reproduce this ~10 times in $ zig build test-std -fqemu --libc-runtimes ../libc -Dtest-target-filter=aarch64 -Dtest-filter=kangarootwelve |
|
Well I just got this, doesn't seem related to the other bug I've been debugging for two days. |
|
Thanks Jacob! Unrolling twice is what seems to provide the best performance on x86_64 and aarch64, and aligns with what we already do for regular SHA3. |
2 participants
KT128 and KT256 are fast, secure cryptographic hash functions based on Keccak (SHA-3).
They can be seen as the modern version of SHA-3, and an evolution of SHAKE, with better performance.
After the SHA-3 competition, the Keccak team proposed these variants in 2016, and the constructions underwent 8 years of public scrutiny before being standardized in October 2025 as RFC 9861.
They uses a tree-hashing mode on top of TurboSHAKE, providing both high security and excellent performance, especially on large inputs.
They support arbitrary-length output and optional customization strings.
Hashing of very large inputs can be done using multiple threads, for high throughput.
KT128 provides 128-bit security strength, equivalent to AES-128 and SHAKE128, which is sufficient for virtually all applications.
KT256 provides 256-bit security strength.
For small inputs, TurboSHAKE128 and TurboSHAKE256 (which KT128 and KT256 are based on) can be used instead as they have less overhead.