The National Institute of Standards and Technology (NIST) this week opened a competition to develop a new cryptographic hash algorithm, a tool that converts a file, message or block of data to a short fingerprint for use in digital signatures, message authentication and other computer security applications. Such hash algorithms are ultimately one of the key security technologies for federal and public systems.

The competition is NIST's response to recent advances in the analysis of hash algorithms. The new hash algorithm will be called Secure Hash Algorithm-3 (SHA-3) and will augment the hash algorithms currently specified in the Federal Information Processing Standard (FIPS) 180-2, Secure Hash Standard.

NIST's goal is that SHA-3 provide increased security and offer greater efficiency for the applications using cryptographic hash algorithms. FIPS standards are required for use in federal civilian computer systems and are often adopted voluntarily by private industry. FIPS 180-2 specifies five cryptographic hash algorithms, including SHA-1 and the SHA-2 family of hash algorithms.

Because serious attacks have been reported in recent years against cryptographic hash algorithms, including SHA-1, NIST has decided to standardize an additional hash algorithm to augment the ones currently specified in FIPS 180-2.

Entries for the competition must be received by October 31, 2008. The competition was announced in the Federal Register Notice published on November 2, 2007. NIST has held two public workshops to assess the status of its approved hash functions and to solicit public input on its cryptographic hash function policy and standard.

As a result of these workshops, NIST has decided to develop one or more additional hash functions through a public competition, similar to the development process of the Advanced Encryption Standard (AES). AES supports key sizes of 128 bits, 192 bits and 256 bits and will serve as a replacement for the Data Encryption Standard (DES), which has a key size of 56 bits. In addition to the increased security that comes with larger key sizes, AES can encrypt data much faster than Triple-DES, a DES enhancement that which essentially encrypts a message or document three times. According to NIST's AES overview: "The AES algorithm is a symmetric block cipher that can encrypt (encipher) and decrypt (decipher) information." It is based on the Rijndael algorithm, named for Belgian researchers Vincent Rijmen and Joan Daemen, who developed it.

NIST initially issued draft minimum acceptability requirements, submission requirements, and evaluation criteria for candidate hash algorithms in January, 2007 for public comments; the comment period ended on April 27, 2007. Based on the public feedback, NIST has revised the requirements and evaluation criteria and issued a Call for a New Cryptographic Hash Algorithm (SHA-3) Family now.