The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)
RFC 7693

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06

Independent Submission                                M-J. Saarinen, Ed.
Request for Comments: 7693                    Queen's University Belfast
Category: Informational                                    J-P. Aumasson
ISSN: 2070-1721                                        Kudelski Security
                                                           November 2015

  The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)

Abstract

   This document describes the cryptographic hash function BLAKE2 and
   makes the algorithm specification and C source code conveniently
   available to the Internet community.  BLAKE2 comes in two main
   flavors: BLAKE2b is optimized for 64-bit platforms and BLAKE2s for
   smaller architectures.  BLAKE2 can be directly keyed, making it
   functionally equivalent to a Message Authentication Code (MAC).

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This is a contribution to the RFC Series, independently of any other
   RFC stream.  The RFC Editor has chosen to publish this document at
   its discretion and makes no statement about its value for
   implementation or deployment.  Documents approved for publication by
   the RFC Editor are not a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7693.

Copyright Notice

   Copyright (c) 2015 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.

Saarinen & Aumasson           Informational                     [Page 1]
RFC 7693               BLAKE2 Crypto Hash and MAC          November 2015

Table of Contents

   1.  Introduction and Terminology  . . . . . . . . . . . . . . . .   3
   2.  Conventions, Variables, and Constants . . . . . . . . . . . .   4
     2.1.  Parameters  . . . . . . . . . . . . . . . . . . . . . . .   4
     2.2.  Other Constants and Variables . . . . . . . . . . . . . .   4
     2.3.  Arithmetic Notation . . . . . . . . . . . . . . . . . . .   4
     2.4.  Little-Endian Interpretation of Words as Bytes  . . . . .   5
     2.5.  Parameter Block . . . . . . . . . . . . . . . . . . . . .   5
     2.6.  Initialization Vector . . . . . . . . . . . . . . . . . .   6
     2.7.  Message Schedule SIGMA  . . . . . . . . . . . . . . . . .   6
   3.  BLAKE2 Processing . . . . . . . . . . . . . . . . . . . . . .   7
     3.1.  Mixing Function G . . . . . . . . . . . . . . . . . . . .   7
     3.2.  Compression Function F  . . . . . . . . . . . . . . . . .   8
     3.3.  Padding Data and Computing a BLAKE2 Digest  . . . . . . .   9
   4.  Standard Parameter Sets and Algorithm Identifiers . . . . . .  10
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .  11
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  11
     6.1.  Normative References  . . . . . . . . . . . . . . . . . .  11
     6.2.  Informative References  . . . . . . . . . . . . . . . . .  11
   Appendix A.  Example of BLAKE2b Computation . . . . . . . . . . .  13
   Appendix B.  Example of BLAKE2s Computation . . . . . . . . . . .  15
   Appendix C.  BLAKE2b Implementation C Source  . . . . . . . . . .  16
     C.1.  blake2b.h . . . . . . . . . . . . . . . . . . . . . . . .  16
     C.2.  blake2b.c . . . . . . . . . . . . . . . . . . . . . . . .  17
   Appendix D.  BLAKE2s Implementation C Source  . . . . . . . . . .  21
     D.1.  blake2s.h . . . . . . . . . . . . . . . . . . . . . . . .  21
     D.2.  blake2s.c . . . . . . . . . . . . . . . . . . . . . . . .  22
   Appendix E.  BLAKE2b and BLAKE2s Self-Test Module C Source  . . .  26
   Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  29
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  30

Saarinen & Aumasson           Informational                     [Page 2]
RFC 7693               BLAKE2 Crypto Hash and MAC          November 2015

1.  Introduction and Terminology

   The BLAKE2 cryptographic hash function [BLAKE2] was designed by Jean-
   Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian
   Winnerlein.

   BLAKE2 comes in two basic flavors:

   o  BLAKE2b (or just BLAKE2) is optimized for 64-bit platforms and
      produces digests of any size between 1 and 64 bytes.

   o  BLAKE2s is optimized for 8- to 32-bit platforms and produces
      digests of any size between 1 and 32 bytes.

   Both BLAKE2b and BLAKE2s are believed to be highly secure and perform