SHAKE128 vs. SHAKE256: A Comparison
SHAKE128 and SHAKE256 are members of the SHA-3 family, standardized by NIST (FIPS 202). They are not traditional hash functions but rather Extendable-Output Functions (XOFs). This means they can produce an output of virtually any desired length, unlike fixed-output hashes like SHA-256 or SHA3-256. Both are based on the Keccak sponge construction, but they differ primarily in their underlying security strength.
What is SHAKE128?
SHAKE128 provides a security strength equivalent to 128 bits against all structural attacks (like collision or preimage attacks), assuming a sufficient output length is used (e.g., 256 bits or more for 128-bit collision resistance). It uses the same Keccak permutation as other SHA-3 functions but with parameters configured for this security level. Because it has a smaller internal capacity compared to SHAKE256, it generally offers higher performance.
What is SHAKE256?
SHAKE256 offers a higher security strength, equivalent to 256 bits against structural attacks (again, assuming sufficient output length, e.g., 512 bits or more for 256-bit collision resistance). It uses the Keccak permutation with parameters set for this higher security level, involving a larger internal capacity. This increased capacity provides a greater security margin but typically comes at the cost of slightly reduced performance compared to SHAKE128.
Key Differences & When to Choose
| Feature | SHAKE128 | SHAKE256 |
|---|---|---|
| Type | Extendable-Output Function (XOF) | Extendable-Output Function (XOF) |
| Underlying Algorithm | Keccak Sponge Construction | Keccak Sponge Construction |
| Security Strength | 128 bits | 256 bits |
| Internal Capacity (Related to Security) | Lower | Higher |
| Performance | Generally Faster | Generally Slower (than SHAKE128) |
| Output Length | Variable (User-defined) | Variable (User-defined) |
| Primary Use Cases | Key derivation, stream ciphers, lightweight crypto, hash-based signatures (where 128-bit security suffices) | Applications requiring higher security, robust key derivation, future-proofing, high-security signatures |
Choosing Between Them
The choice between SHAKE128 and SHAKE256 depends directly on the security requirements of your application:
- Choose SHAKE128 if a 128-bit security level is sufficient for your application and performance is a significant consideration. Many protocols and lightweight cryptographic schemes operate comfortably at this security level.
- Choose SHAKE256 if you require a higher 256-bit security level, need a larger security margin against future attacks, or are building systems intended for very long-term security. The performance cost is usually acceptable for the increased security assurance.
Both are excellent, flexible functions built on the secure foundation of Keccak, offering significant advantages over older hash constructions, especially their immunity to length extension attacks and their ability to generate outputs of arbitrary length.