HN Explorer

14 comments

[ 3.4 ms ] story [ 58.0 ms ] thread
dchest
Similarly:

    BLAKE2s (32-bit words) - 554 MiB/s
    BLAKE2b (64-bit words) - 890 MiB/s
(source: https://blake2.net/)

The difference is also clear in pure JavaScript implementations — JS doesn't have native 64-bit integer operations yet, so SHA-512 is slower there:

   SHA-256 - 103.17 MiB/s
   SHA-512 -  34.29 MiB/s
Note that since SHA-512 eats 128-byte blocks, while SHA-256 64-byte blocks, hashing very short strings may be faster with SHA-256 even on 64-bit platforms (the same applies to BLAKE2).
shakna
> in pure JavaScript implementations

Is not JS cryptography a bad idea?

angry_octet
No JS per se. In browser client side crypto though...
gcp
Harder to defend against timing attacks in JS, which are exactly some of the strongest attacks against modern cryptosystems.
angry_octet
Do you mean because of the lack of low level control/bit manipulation, vs C/asm, or something else? I would have guessed it was about the same as any interpreted/jitted higher level language (python/php/c#/java).
loeg
Yep. Taking advantage of SHA512's superior performance while still producing a 256 bit result is the raison d'être of SHA-512/256.
meta_AU
Well... only if you ignore the advantages of immunity to length extension.
[deleted]
(comment deleted)
nstr10
I would be curious to see this compared with SHA-384, and across multiple languages.
cperciva
SHA-384 is exactly the same speed as SHA-512. SHA-512/256 is also the same speed -- it's basically SHA-512 with the output truncated to 256 bits.
loeg
SHA 224/384 are just truncated forms of the same algorithm as SHA 256/512, respectively. (With different initial constants, as well, but that doesn't matter for this.)
hyh1048576
As a side note, there are some cryptocurrency project using half of the sha512, since it's faster and using a 256 bit hash saves spaces.
joshuak
We use this fact in our ID system. Consider bloom filters... so many different 'hash functions' you get for free out of 64 bytes of hash data.
kobeya
"... amortized per byte."

SHA-512 is in fact slower per iteration, but uses twice the block size as SHA-256. For hashing e.g. files, the per-byte number is what matters. But when doing hash trees, for example, the per-iteration performance is what matters and SHA-256 wins out there.