Skip to content

Commit 42f9a8c

Browse files
panvapanva
committed
add TurboSHAKE and KangarooTwelve
1 parent 8a09cc5 commit 42f9a8c

File tree

1 file changed

+249
-1
lines changed

1 file changed

+249
-1
lines changed

‎index.html‎

Lines changed: 249 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,12 @@
7777
"publisher": "NIST",
7878
"date": "December 2016"
7979
},
80+
"RFC9861": {
81+
"title": "KangarooTwelve and TurboSHAKE",
82+
"href": "https://www.rfc-editor.org/rfc/rfc9861.html",
83+
"publisher": "IETF",
84+
"date": "October 2025"
85+
},
8086
"draft-ietf-jose-pqc-kem-01": {
8187
"title": "Post-Quantum Key Encapsulation Mechanisms (PQ KEMs) for JOSE and COSE",
8288
"href": "https://www.ietf.org/archive/id/draft-ietf-jose-pqc-kem-01.html",
@@ -121,7 +127,7 @@
121127
This specification defines a number of post-quantum secure and
122128
modern cryptographic algorithms for the [[webcrypto | Web Cryptography API]],
123129
namely ML-KEM, ML-DSA, SLH-DSA, AES-OCB, ChaCha20-Poly1305,
124-
SHA-3, cSHAKE, KMAC, and Argon2.
130+
SHA-3, cSHAKE, TurboSHAKE, KangarooTwelve, KMAC, and Argon2.
125131
</p>
126132
</section>
127133
<section id="sotd">
@@ -145,6 +151,7 @@ <h2>Introduction</h2>
145151
<li><a href="#chacha20-poly1305">ChaCha20-Poly1305</a> [[RFC8439]]</li>
146152
<li><a href="#sha3">SHA3-256, SHA3-384, and SHA3-512</a> [[FIPS-202]]</li>
147153
<li><a href="#cshake">cSHAKE128, cSHAKE256</a>, <a href="#kmac">KMAC128 and KMAC256</a> [[NIST-SP800-185]]</li>
154+
<li><a href="#turboshake">TurboSHAKE128, TurboSHAKE256</a>, <a href="#kangarootwelve">KT128 and KT256</a> [[RFC9861]]</li>
148155
<li><a href="#argon2">Argon2d, Argon2i, and Argon2id</a> [[RFC9106]]</li>
149156
</ul>
150157
</p>
@@ -6106,6 +6113,247 @@ <h5>Digest</h5>
61066113
</section>
61076114
</section>
61086115
</section>
6116+
<section id="turboshake">
6117+
<h3>TurboSHAKE</h3>
6118+
<section id="turboshake-description" class="informative">
6119+
<h4>Description</h4>
6120+
<p>
6121+
This describes TurboSHAKE128 and TurboSHAKE256, as specified by
6122+
[[RFC9861]].
6123+
</p>
6124+
<p>
6125+
TurboSHAKE is a family of eXtendable-Output Functions (XOFs) based on a
6126+
round-reduced version of the Keccak permutation used in SHA-3, making it
6127+
roughly twice as fast as the SHAKE functions while maintaining the same
6128+
security strength.
6129+
</p>
6130+
<p class="note">
6131+
For 128-bit collision security, TurboSHAKE128 output should be at least 256 bits.
6132+
For 256-bit collision security, TurboSHAKE256 output should be at least 512 bits.
6133+
When the output length meets these thresholds, TurboSHAKE128 achieves NIST post-quantum
6134+
security level 2, and TurboSHAKE256 achieves level 5.
6135+
</p>
6136+
</section>
6137+
<section id="turboshake-registration">
6138+
<h4>Registration</h4>
6139+
<p>
6140+
The <a data-cite="webcrypto#recognized-algorithm-name">recognized algorithm names</a> are
6141+
"<code id="alg-turboshake128">TurboSHAKE128</code>" and
6142+
"<code id="alg-turboshake256">TurboSHAKE256</code>".
6143+
</p>
6144+
<table>
6145+
<thead>
6146+
<tr>
6147+
<th><a data-cite="webcrypto#supported-operations">Operation</a></th>
6148+
<th><a data-cite="webcrypto#algorithm-specific-params">Parameters</a></th>
6149+
<th><a data-cite="webcrypto#algorithm-result">Result</a></th>
6150+
</tr>
6151+
</thead>
6152+
<tbody>
6153+
<tr>
6154+
<td>digest</td>
6155+
<td>{{TurboShakeParams}}</td>
6156+
<td>[= byte sequence =]</td>
6157+
</tr>
6158+
</tbody>
6159+
</table>
6160+
</section>
6161+
<section id="turboshake-params">
6162+
<h4><dfn data-idl id="dfn-TurboShakeParams">TurboShakeParams</dfn> dictionary</h4>
6163+
<pre class=idl>
6164+
dictionary TurboShakeParams : Algorithm {
6165+
required [EnforceRange] unsigned long length;
6166+
[EnforceRange] octet domainSeparation;
6167+
};
6168+
</pre>
6169+
<p>The <dfn data-dfn-for=TurboShakeParams id=dfn-TurboShakeParams-length>length</dfn> member represents the requested output length in bits.</p>
6170+
<p>The <dfn data-dfn-for=TurboShakeParams id=dfn-TurboShakeParams-domainSeparation>domainSeparation</dfn> member represents the domain separation byte. If not specified, it defaults to <code>0x1F</code>. Valid values are in the range <code>0x01</code> to <code>0x7F</code>.</p>
6171+
<p class="note">
6172+
Protocols that use both KangarooTwelve and TurboSHAKE should avoid using the values
6173+
<code>0x06</code>, <code>0x07</code>, and <code>0x0B</code> for domain separation,
6174+
as these are used internally by KangarooTwelve.
6175+
</p>
6176+
</section>
6177+
<section id="turboshake-operations">
6178+
<h4>Operations</h4>
6179+
<section id="turboshake-operations-digest">
6180+
<h5>Digest</h5>
6181+
<ol>
6182+
<li>
6183+
<p>
6184+
Let |length| be the {{TurboShakeParams/length}} member of
6185+
|normalizedAlgorithm|.
6186+
</p>
6187+
</li>
6188+
<li>
6189+
<p>
6190+
Let |domainSeparation| be the {{TurboShakeParams/domainSeparation}} member of
6191+
|normalizedAlgorithm| if present, or <code>0x1F</code> otherwise.
6192+
</p>
6193+
</li>
6194+
<li>
6195+
<p>
6196+
If |domainSeparation| is less than <code>0x01</code> or greater than <code>0x7F</code>,
6197+
then [= exception/throw =] an {{OperationError}}.
6198+
</p>
6199+
</li>
6200+
<li>
6201+
<dl class="switch">
6202+
<dt>
6203+
If the {{Algorithm/name}} member of
6204+
|normalizedAlgorithm| is a case-sensitive string match for
6205+
"`TurboSHAKE128`":
6206+
</dt>
6207+
<dd>
6208+
Let |result| be the result of performing the TurboSHAKE128 function
6209+
defined in Section 2 of [[RFC9861]] using
6210+
|message| as the |M| input parameter,
6211+
|domainSeparation| as the |D| input parameter, and
6212+
|length| divided by 8 as the |L| input parameter.
6213+
</dd>
6214+
<dt>
6215+
If the {{Algorithm/name}} member of
6216+
|normalizedAlgorithm| is a case-sensitive string match for
6217+
"`TurboSHAKE256`":
6218+
</dt>
6219+
<dd>
6220+
Let |result| be the result of performing the TurboSHAKE256 function
6221+
defined in Section 2 of [[RFC9861]] using
6222+
|message| as the |M| input parameter,
6223+
|domainSeparation| as the |D| input parameter, and
6224+
|length| divided by 8 as the |L| input parameter.
6225+
</dd>
6226+
</dl>
6227+
</li>
6228+
<li>
6229+
<p>
6230+
If performing the operation results in an error, then [= exception/throw =] an {{OperationError}}.
6231+
</p>
6232+
</li>
6233+
<li>
6234+
<p>
6235+
Return |result|.
6236+
</p>
6237+
</li>
6238+
</ol>
6239+
</section>
6240+
</section>
6241+
</section>
6242+
<section id="kangarootwelve">
6243+
<h3>KangarooTwelve</h3>
6244+
<section id="kangarootwelve-description" class="informative">
6245+
<h4>Description</h4>
6246+
<p>
6247+
This describes KT128 and KT256, as specified by
6248+
[[RFC9861]].
6249+
</p>
6250+
<p>
6251+
KangarooTwelve is a family of eXtendable-Output Functions (XOFs) that applies
6252+
tree hashing on top of TurboSHAKE, enabling parallel processing of input data.
6253+
KT128 uses TurboSHAKE128 internally, while KT256 uses TurboSHAKE256.
6254+
</p>
6255+
<p class="note">
6256+
For 128-bit collision security, KT128 output should be at least 256 bits.
6257+
For 256-bit collision security, KT256 output should be at least 512 bits.
6258+
When the output length meets these thresholds, KT128 achieves NIST post-quantum
6259+
security level 2, and KT256 achieves level 5.
6260+
</p>
6261+
</section>
6262+
<section id="kangarootwelve-registration">
6263+
<h4>Registration</h4>
6264+
<p>
6265+
The <a data-cite="webcrypto#recognized-algorithm-name">recognized algorithm names</a> are
6266+
"<code id="alg-kt128">KT128</code>" and
6267+
"<code id="alg-kt256">KT256</code>".
6268+
</p>
6269+
<table>
6270+
<thead>
6271+
<tr>
6272+
<th><a data-cite="webcrypto#supported-operations">Operation</a></th>
6273+
<th><a data-cite="webcrypto#algorithm-specific-params">Parameters</a></th>
6274+
<th><a data-cite="webcrypto#algorithm-result">Result</a></th>
6275+
</tr>
6276+
</thead>
6277+
<tbody>
6278+
<tr>
6279+
<td>digest</td>
6280+
<td>{{KangarooTwelveParams}}</td>
6281+
<td>[= byte sequence =]</td>
6282+
</tr>
6283+
</tbody>
6284+
</table>
6285+
</section>
6286+
<section id="kangarootwelve-params">
6287+
<h4><dfn data-idl id="dfn-KangarooTwelveParams">KangarooTwelveParams</dfn> dictionary</h4>
6288+
<pre class=idl>
6289+
dictionary KangarooTwelveParams : Algorithm {
6290+
required [EnforceRange] unsigned long length;
6291+
BufferSource customization;
6292+
};
6293+
</pre>
6294+
<p>The <dfn data-dfn-for=KangarooTwelveParams id=dfn-KangarooTwelveParams-length>length</dfn> member represents the requested output length in bits.</p>
6295+
<p>The <dfn data-dfn-for=KangarooTwelveParams id=dfn-KangarooTwelveParams-customization>customization</dfn> member represents the customization string. The application selects this string to define a variant of the function. If not specified, it defaults to the empty string.</p>
6296+
</section>
6297+
<section id="kangarootwelve-operations">
6298+
<h4>Operations</h4>
6299+
<section id="kangarootwelve-operations-digest">
6300+
<h5>Digest</h5>
6301+
<ol>
6302+
<li>
6303+
<p>
6304+
Let |length| be the {{KangarooTwelveParams/length}} member of
6305+
|normalizedAlgorithm|.
6306+
</p>
6307+
</li>
6308+
<li>
6309+
<p>
6310+
Let |customization| be the {{KangarooTwelveParams/customization}} member of
6311+
|normalizedAlgorithm| if present or the empty octet
6312+
string otherwise.
6313+
</p>
6314+
</li>
6315+
<li>
6316+
<dl class="switch">
6317+
<dt>
6318+
If the {{Algorithm/name}} member of
6319+
|normalizedAlgorithm| is a case-sensitive string match for
6320+
"`KT128`":
6321+
</dt>
6322+
<dd>
6323+
Let |result| be the result of performing the KT128 function
6324+
defined in Section 3 of [[RFC9861]] using
6325+
|message| as the |M| input parameter,
6326+
|customization| as the |C| input parameter, and
6327+
|length| divided by 8 as the |L| input parameter.
6328+
</dd>
6329+
<dt>
6330+
If the {{Algorithm/name}} member of
6331+
|normalizedAlgorithm| is a case-sensitive string match for
6332+
"`KT256`":
6333+
</dt>
6334+
<dd>
6335+
Let |result| be the result of performing the KT256 function
6336+
defined in Section 3 of [[RFC9861]] using
6337+
|message| as the |M| input parameter,
6338+
|customization| as the |C| input parameter, and
6339+
|length| divided by 8 as the |L| input parameter.
6340+
</dd>
6341+
</dl>
6342+
</li>
6343+
<li>
6344+
<p>
6345+
If performing the operation results in an error, then [= exception/throw =] an {{OperationError}}.
6346+
</p>
6347+
</li>
6348+
<li>
6349+
<p>
6350+
Return |result|.
6351+
</p>
6352+
</li>
6353+
</ol>
6354+
</section>
6355+
</section>
6356+
</section>
61096357
<section id="kmac">
61106358
<h3>KMAC</h3>
61116359
<section id="kmac-description" class="informative">

0 commit comments

Comments
 (0)