ECRYPT Lightweight Hash Functions Page

Implementations of hash functions in Atmel AVR devices.
(see also our block ciphers project)

Please refer to the following companion paper whenever you use the source codes: Josep Balasch, Baris Ege, Thomas Eisenbarth, Benoit Gérard, Zheng Gong, Tim Güneysu, Stefan Heyse, Stéphanie Kerckhof, François Koeune, Thomas Plos, Thomas Pöppelmann, Francesco Regazzoni, François-Xavier Standaert, Gilles Van Assche, Ronny Van Keer, Loïc van Oldeneel tot Oldenzeel, Ingo von Maurich, Compact Implementation and Performance Evaluation of Hash Functions in ATtiny Devices, to appear in the proceedings of CARDIS 2012, Lecture Notes in Computer Science, vol xxxx, pp yyy-zzz, Graz, Austria, November 2012, (pdf file).

Hash functions that are efficiently implemented in low cost embedded devices are important components for securing new applications in ubiquitous computing. This page reports on the performance evaluation of standard and emerging hash functions, in the Atmel AVR Attiny45 8-bit RISC microcontroller. In order to increase the transparency of the evaluation, we make all source codes used in the evaluations available under an open source license. The performance indicators chosen are: code size (rom and ram), and cycle count when hashing 8-byte, 50-byte, 100-byte and 500-byte messages. All implementations are provided as a single file and contain three routines (init, update and final), that can be used by the following common interface.

The hash functions under investigation are:

  • Standard hash functions and SHA3 candidates.
    - SHA256: specifications and source code
    - BLAKE-256: specifications and source code.
    - Grostl-256: specifications and source code.
    - JH-256: specifications and source code.
    - Keccak[r=1088,c=512]: specifications and source code.
    - Skein-512-256: specifications and source code.
  • Lightweight hash functions.
    - D-Quark: specifications and source code.
    - S-Quark: specifications and source code.
    - PHOTON-160/36/36: specifications and source code.
    - PHOTON-256/32/32: specifications and source code.
    - SPONGENT-160/160/80: specifications and source code.
    - SPONGENT-256/256/128: specifications and source code.
    - (small) Keccak[r=240,c=160]: specifications and source code.
    - (small) Keccak[r=144,c=256]: specifications and source code.
  • Block cipher based constructions.
    - Rogaway/Steinberger LP362 based on NOEKEON: specifications part #1, part #2, and source code.
    - Shrimpton/Stam based on Rijndael-256/256: specifications part #1, part #2, and source code Rijndael-256, Shrimpton/Stam.
    - Hirose based on AES-256: specifications part #1, part #2, and source code
    - Davies/Meyer based on Rijndael-256/256: specifications and source code Rijndael-256, Davies/Meyer.
    - Davies/Meyer based on SEA-192/8: specifications and source code.

    The performance evaluations of the different hash functions (i.e. init + update + final) are given below. Note that for certain (e.g. sponge-based) functions, the data part of the RAM could be arbitrarily reduced by changing the interface (in which case, this part of the memory is reported in grey). Some additional results (for variants of the main versions investigated) are also given in the fourth part of the table.

    Remark. For lightweight hash functions, different versions of the algorithms are provided (aiming for 256-bit and 160-bit hashes with "flat security", i.e. n/2-bit preimage security, second preimage security and collision resistance). Despite the similar names, these versions correspond to different specifications (hence I/O behavior). For example, the lightweight versions of Keccak are not the same as the standard one. In order to avoid confusion we refer to them as Keccak and (small) Keccak. The same comment holds for (small) Skein-256-256 which is given in the additional results table.

  • Standard hash functions and SHA3 candidates.

    Hash function Digest size [bits] Code size [bytes] RAM data [bytes] RAM state and others [bytes] RAM stack Cycle count (8-byte message) Cycle count (50-byte message) Cycle count (100-byte message) Cycle count (500-byte message)
    SHA256 256 1090 64 73 6 33 600 33 600 66 815 266 105
    BLAKE-256 256 1166 64 120 9 35 714 35 714 70 808 281 372
    Groestl-256 256 1400 64 128 9 61 007 61 049 101 279 342 759
    JH-256 256 1020 64 162 8 524 602 524 518 785 510 2 531 262
    Keccak[r=1088,c=512]* 256 868 136 240 4 178 022 178 022 179 494 716 483
    Skein-512-256 256 988 64 160 8 532 346 532 388 798 290 2 393 802
    * benchmarked on the AtTiny85 because the read-only input buffer did not fit in the ATtiny45 and our interface did not allow that the message could be directly XORed into the state, hence resulting in an excessive RAM for the AtTiny45.

  • Lightweight hash functions.

    Hash function Digest size [bits] Code size [bytes] RAM data [bytes] RAM state and others [bytes] RAM stack Cycle count (8-byte message) Cycle count (50-byte message) Cycle count (100-byte message) Cycle count (500-byte message)
    S-Quark 256 1106 4 60 5 708 783 1 417 611 2 339 023 9 4270 23
    PHOTON-256/32/32 256 1244 4 68 10 254 871 486 629 787 896 3 105 396
    SPONGENT-256/256/128 256 364 16 96 5 1 542 923 3 856 916 6 170 900 25 454 100
    (small) Keccak[r=144,c=256] 256 608 18 92 4 90 824 181 466 317 221 1 313 291
    D-Quark 176 974 2 42 5 631 871 1 516 685 2 570 035 10 996 835
    PHOTON-160/36/36 160 764 9 39 11 620 921 1 655 364 2 793 265 11 999 914
    SPONGENT-160/160/80 160 598 10 60 6 795 294 2 783 241 4 771 186 20 674 746
    (small) Keccak[r=40,c=160] 160 752 5 45 3 58 063 162 347 278 269 1 205 627

  • Block cipher based constructions.

    Hash function Digest size [bits] Code size [bytes] RAM data [bytes] RAM state and others [bytes] RAM stack Cycle count (8-byte message) Cycle count (50-byte message) Cycle count (100-byte message) Cycle count (500-byte message)
    Rogaway-Steinberger LP362 based on NOEKEON 256 752 16 66 10 239 828 479 485 838 884 3 833 859
    Shrimpton/Stam based on Rijndael-256/256 256 734 32 130 6 39 738 79 313 158 429 633 225
    Hirose based on AES-256 256 1080 16 82 6 9918 39 111 68 304 311 579
    Davies/Meyer based on Rijndael-256/256 256 696 32 98 6 13 438 26 705 53 205 212 305
    Davies/Meyer based on SEA-192/8 192 701 24 50 10 134 121 402 055 669 997 2 947 536

  • Additional results.

    Hash function Digest size [bits] Code size [bytes] RAM data [bytes] RAM state and others [bytes] RAM stack Cycle count (8-byte message) Cycle count (50-byte message) Cycle count (100-byte message) Cycle count (500-byte message)
    SHA256 (fast) 256 1242 64 73 6 26 208 26 208 52 031 206 969
    (small) Keccak[r=544,c=256] 256 672 68 120 4 93 170 93 842 187 153 748 619
    (small) Keccak[r=640,c=160] 160 672 80 120 3 93 170 93 842 187 153 656 108
    (small) Keccak[r=240,c=160] 160 570 30 60 3 45 394 91 051 181 821 773 026
    (small) Skein-256-256 256 1316 32 80 10 212 872 319 154 531 681 1 806 949
    Rogaway-Steinberger lp362 based on NOEKEON 256 650 16 66 10 239 200 478 233 836 696 3 823 871

  • Additional versions.
    - SHA256 (fast) source code.
    - (small) Keccak[r=40,c=160], (small) Keccak[r=640,c=160], (small) Keccak[r=544,c=256] source code.
    - (small) Skein-256-256 source code.
    - Rogaway-Steinberger lp362 based on NOEKEON source code.