• On an Intel Core i5-2400M (Sandy Bridge), BLAKE-256 can hash at 7.49 cycles/byte and BLAKE-512 at 5.64 cycles/byte (details).
• On an AMD FX-8120 (Bulldozer), BLAKE-256 can hash at 11.83 cycles/byte and BLAKE-512 at 6.88 cycles/byte (details).
• On a Cortex-M3 based microcontroller (32-bit processor), BLAKE-256 can be implemented with 280 bytes of RAM and 1320 bytes of ROM, and BLAKE-512 with 516 bytes of RAM and 1776 bytes of ROM (details).
• On an ATmega1284P microcontroller (8-bit processor), BLAKE-256 can be implemented with 267 bytes of RAM and 3434 bytes of ROM, and BLAKE-512 with 525 bytes of RAM and 6350 bytes of ROM (details).
• On a Xilinx Virtex 5 FPGA, BLAKE-256 implemented with 56 slices can reach a throughput of more than 160 Mbps, and BLAKE-512 with 108 slices can reach a throughput of more than 270 Mbps (details).
• In 180nm ASIC, BLAKE-256 can be implemented with 13.5 kGE. In 90nm ASIC, BLAKE-256 implemented with 38 kGE can reach a throughput of more than 10 Gbps, and BLAKE-512 with 79 kGE can reach a throughput of more than 15 Gbps (details).

• Jean-Philippe Aumasson (Kudelski Security,Switzerland)
• Luca Henzen (thenETHZ, Switzerland;nowUBS, Switzerland)
• Willi Meier (FHNW, Switzerland)
• Raphael C.-W. Phan (LoughboroughUniversity, UK)

Final BLAKE

Downloads

• Documentation, includingspecification, implementation report, preliminary analysis
• Toy versions BLOKE, FLAKE, BLAZE, and BRAKE
• Slides of the presentation of BLAKE at the First SHA-3 Conference
• Slides of the presentation of BLAKE at the Second SHA-3 Conference
• Slides of the presentation of BLAKE at the Third SHA-3 Conference
• Slides of the presentation "Quo vadis BLAKE?" at the 2011 "Quo Vadis Cryptology?" workshop
• Reference C implementations:
• blake_c.tar.gz:C implementations with command-line interface to hash files, simpler andshorter code than the NIST reference (also onGitHub)
• blake_ref.c,blake_ref.h:reference implementation for NIST's API (2015.09.07: fixed a bug thatgave incorrect hashes in specific use cases)
• Reference VHDL implementations:
  • blake_vhdl_v2.tar.gz: reference implementations, with fourdifferent architectures
  • http://www.iis.ee.ethz.ch/~sha3/blake/:speed-optimized implementations (as describedinHAMP10.pdf)
  • compact_blake256_vhdl.tar.gz:low-area implementation of BLAKE-256 (as describedinHAMP10.pdf)
  • blakechip.jpg: picture of the chip containing our 13.5 kGE implementation of the full BLAKE-256
• TheBLAKE building (Washington, DC)

Cryptanalysis

• 2011 Nov 18: Donghoon Chang, Mridul Nandi, Moti Yung.Indifferentiability ofthe hash algorithm BLAKE. IACR ePrint archive, report 2011/620
  Main result: proof of indifferentiability
  
  
• 2011 Nov 17: Elena Andreeva, Atul Luykx, Bart Mennink.Provablesecurity of BLAKE with non-ideal compression function. ThirdSHA-3 Conference, IACR ePrint archive, report 2011/620
  Mainresult: proof of indifferentiability
  
  
• 2011 May 19: Orr Dunkelman, Dmitry Khovratovich.Iterativedifferentials, symmetries, and message modification inBLAKE-256. ECRYPT2 Hash Workshop 2011
  Main result: distinguisher for the permutation of BLAKE-256 reduced to 6 middle rounds, with complexity 2⁴⁵⁶
  
  
• 2011 May 12: JPA, Gaëtan Leurent, Willi Meier, Florian Mendel,Nicky Mouha, Raphael C.-W. Phan, Yu Sasaki, Petr Susil.Tuple cryptanalysis of ARXwith application to BLAKE and Skein. ECRYPT2 Hash Workshop 2011
  Main result: distinguisher for the permutation ofBLAKE-256 reduced to 4 middle rounds, with complexity 2⁶⁴
  
  
• 2011 Mars 23: Dmitry Khovratovich, Gaëtan Leurent, María Naya-Plasencia.Observations on Blake (slides). Technical report
  Main result: conjectured distinguisher for 10 rounds ofthe permutation
  
  
• 2011 Feb 15: Alex Biryukov, Ivica Nikolic, Arnab Roy.Boomerangattacks on BLAKE-32 (slides). FSE 2011
  Main result: distinguishers for the compression function (resp. permutation) of BLAKE-256 reduced to 7 (resp. 8) rounds, with complexity 2²³² (resp. 2²⁴²)
  
  
• 2010 Dec 17: Mao Ming, He Qiang, Shaokun Zeng.Securityanalysis of BLAKE-32 based on differential properties (abstract). ICCIS 2010
  Main result: analysis of differential properties, and evidence that the attack considered is inapplicable to 6 rounds of BLAKE-256
  
  
• 2010 Aug 23: Meltem Sönmez Turan, Erdener Uyan.Practicalnear-collisions for reduced round Blake, Fugue, Hamsi and JH. Second SHA-3 Conference
  Main result: near-collision attacks on resp. 209 and 184 bits for the compression function of BLAKE-256 reduced to resp. 1.5 and 2 rounds, with complexity 2²⁶
  
  
• 2010 Jul 1: Janoš Vidali, Peter Nose, Enes Pašalic.Collisions for variants of the BLAKE hash function. Information Processing Letters, volume 110, issues 14-15
  Main result: efficient collision attacks for the toy version BLOKE, and for the compression function of the toy version BRAKE
  
  
• 2010 Jun 18: Bozhan Su, Wenling Wu, Shuang Wu, LeDong.Near collisions onthe reduced-round compression functions of Skein andBLAKE. IACR ePrint archive, report 2010/355
  Main result: near-collision attacks on resp. 152, 396, and 306 bits for the compression function of BLAKE-256, -512, -512 reduced to 4, 4, 5 middle rounds with complexity 2²¹, 2¹⁶, and 2²¹⁶
  
  
• 2010 Jan 29: Jean-Philippe Aumasson, Jian Guo, Simon Knellwolf, Krystian Matusiewicz, Willi Meier.Differential and invertibilityproperties of BLAKE. FSE 2010. IACR ePrint archive, report 2010/043
  Main result: proof that one round is a permutation ofthe message, for a fixed state; improved preimage attack on 1.5rounds; impossible differentials for the permutation with 5 (resp. 6)rounds for BLAKE-256 (resp. BLAKE-512)
  
  
• 2009 Dec 7: Lei Wang, Kazuo Ohta, Kazuo Sakiyama.Free-start preimages of step-reduced Blake compression function. Rump session of ASIACRYPT 2009
  Main result: preimage attacks for the permutation ofBLAKE-256 reduced to 4.5 rounds and followed by the finalization, withcomplexity 2²⁵² and memory 2⁸
  
  
• 2009 Jun 23: Jian Guo, Krystian Matusiewicz.Round-reducednear-collisions of BLAKE-32. WEWoRC 2009
  Main result: near-collision attack on 232 bits forthe compression of BLAKE-256 reduced to 4 middle rounds (rounds 3to 6), with complexity 2⁵⁶; uses differences in thechaining value, the salt, the counter, and the message
  
  
• 2009 May 26: Li Ji, XuLiangyu.Attacks onround-reduced BLAKE. IACR ePrint archive, report 2009/238
  Main result: collision and preimage attacks for BLAKE with compression function reduced to 2.5 rounds. Respectively for BLAKE-224, -256, -384, and -512, collision attacks have complexities 2⁹⁶, 2¹¹², 2¹⁶⁰, and 2²²⁴; preimage attacks have complexities 2²⁰⁹, 2²⁴¹, 2³⁵⁵, and 2⁴⁸¹

Software implementations

• 2012 Jul 24: Dmitry Chestnykh.dart-blake.
  Main result: Dart implementation of BLAKE-256
  
  
• 2012 May 16: Samuel Neves, Jean-PhilippeAumasson.Implementing BLAKE with AVX, AVX2, and XOP.
  Main result: extended version of the SHA-3 Conference paper with refinedanalysis of AVX2 and XOP implementations
  
  
• 2012 Apr 3: Samuel Neves, Jean-PhilippeAumasson.BLAKEand 256-bit advanced vector extensions. Third SHA-3 Conference
  Main result:implementations using AVX, XOP (availableinSUPERCOP), andAVX2 extensions(availablehere)
  
  
• 2012 Feb 29: MarkRhodes.Blake-512in Javascript.
  Main result: Javascript implementationof BLAKE-512
  
  
• 2012 Jan 8: ChristianWenzel-Benner.arm_thumb2. (linkto SUPERCOP)
  Main result: port of the arm11 implementation toThumb-2 instruction set (as required by ARM cores such as theCortex-M3).
  
  
• 2012 Jan 3: DavidLazar.HMAC mode forBLAKE.
  Main result: C implementation of HMAC for allinstances of BLAKE
  
  
• 2011 Nov 21: Peter Schwabe, Bo-Yin Yang, Shang-Yi Yang.arm11. (link to SUPERCOP)
  Main result: assembly implementation of BLAKE-256 for ARM11 architecture
  
  
• 2011 Nov 21: Ingo vonMaurich.Blake256-AVR-asm.
  Main result: assembly implementation of BLAKE-256 for 8-bit AVRATmega microcontrollers, using 251 bytes of RAM and running at 456cycles/byte
  
  
• 2011 Nov 21: DominikReichl.BlakeSharp.
  Main result: C# implementations of BLAKE-256 and BLAKE-512 (.NET and Mono compatible)
  
  
• 2011 Nov 15: DmitryChestnykh.blake256.
  Main result: Go implementation of BLAKE-256
  
  
• 2011 Nov 14: Marc Greim.blake-512-java-implementation.
  Main result: Java implementation of BLAKE-512
  
  
• 2011 Nov 14: KevinCantu.Haskell-BLAKE.
  Main result: Haskell implementation of BLAKE
  
  
• 2011 Aug 12: Gaëtan Leurent.Vectorized BLAKE implementations. (link to SUPERCOP)
  Main result: C implementations of BLAKE-256 and BLAKE-512 exploiting the SSSE3 extensions and ARM's NEON extensions
  
  
• 2011 May 31: Thomas Burgess, Joseph Jelley, David Smith, ClaireWeston.BLAKE256_matlab.zip.
  Main result: MATLAB implementation of BLAKE-256, non-object-oriented
  
  
• 2011 May 26: Zeke Steer.Blake_256.m.
  Main result: MATLAB implementation of BLAKE-256, object-oriented(test program)
  
  
• 2011 May 12: LarryBugbee.blake.py.
  Main result: Python (2 and 3) implementations of BLAKE
  
  
• 2011 Jan 27: DanielCorrea.blakehash-php.
  Main result: PHP extension implementing BLAKE
  
  
• 2010 Dec 14:Gray.Digest::BLAKE.
  Main result: Perl interface to BLAKE
  
  
• 2010 Aug 19: Joppe W. Bos and DeianStefan.Performanceanalysis of the SHA-3 candidates on exotic multi-corearchitectures. CHES 2010
  Main result: parallelimplementation of BLAKE-32 on a Cell Broadband Engine (processor forSony PS3) running at 5 cycles/byte and on NVIDIA GTX 295 GPU at 0.27 cycles/byte
  
  
• 2010 May 11: ThomasPornin.sphlib.
  Main result: C and Java implementation of BLAKE-256 andBLAKE-512 in the sphlib library and speed measurements on variousplatforms
  
  
• 2010 May 10: ChristopherDrost.sha3-js.
  Main result: Javascript implementation of BLAKE-32 (see alsotheonlinedemo)
  
  
• 2009 Oct 7: SamuelNeves.ChaChaimplementation.
  Main result: C implementationsof BLAKE-32 and BLAKE-64 optimized for Intel Core 2 and i7 processorsusing SSSE3 extensions; on a Core 2 E8400, measured speed-up from10.34 to 9.05 cycles/byte for BLAKE-32, and from 13.65 to 11.80 forBLAKE-64
  
  
• 2009 May 29: Kota Ideguchi, Toru Owada, HirotakaYoshida.Astudy on RAM requirements of various SHA-3 candidates on low-cost8-bit CPUs. IACR ePrint archive, report 2009/260
  Main result: estimates RAM requirements of BLAKE-32 on"low-bit 8-bit CPUs" to 96 bytes
  
  
• 2009 May 25: DanielOtte.AVR-Crypto-Lib/en.
  Main result: C implementations of BLAKE on AVR microcontroller,running at 1115 cycles/byte for BLAKE-28 and -32, and 3989 cycles/bytefor BLAKE-48 and -64

Hardware implementations

• 2012 Mar 13: Jens-Peter Kaps, Panasayya Yalla, Kishore KumarSurapathi, Bilal Habib, Susheel Vadlamudi, Smriti Gurung, John Pham.Lightweightimplementations of SHA-3 candidates on FPGAs. INDOCRYPT 2011
  Main result: lightweight implementation of BLAKE-256 on Spartan3, Virtex 5, Virtex 6, and Cyclone II FPGA devices
  
  
• 2012 Jan 23: Xu Guo, Meeta Srivastav, Sinan Huang, MichaelB. Henry, Leyla Nazhandali, Patrick Schaumont.ASICimplementations of five SHA-3 finalists. DATE 2012
  Mainresult: implementation of BLAKE-256 on 130 nm ASIC
  
  
• 2011 Sep 26: Olakunle Esuruoso.HighSpeed FPGA Implementation of Cryptographic HashFunction. Master thesis, U Windsor, Canada
  Main result:implementation of BLAKE-256 on Cyclone II FPGA device using Altera'sNios II build tools to save computation by memorizing frequentlyhashed prefixes
  
  
• 2011 May 19: Ekawat Homsirikamol, Marcin Rogawski, Kris Gaj.Comparinghardware performance of round 3 SHA-3 candidates using multiplehardware architecture in Xilinx and Altera FPGAs. ECRYPT2 HashWorkshop 2011
  Main result: implementations of BLAKE-256 and BLAKE-512on Virtex 5, Virtex 6, Stratix III, and Stratix IV FPGA devices
  
  
• 2011 May 19: Malik Umar Sharif, Rabia Shahid, Marcin Rogawski, Kris Gaj.Useof embedded FPGA resources in implementations of five round threeSHA-3 candidates. ECRYPT2 Hash Workshop 2011
  Main result: implementations of BLAKE-256 on Virtex 5,Spartan 3, Stratix III, and Cyclone II FPGA devices
  
  
• 2011 May 19: Stéphanie Kerckhof, François Durvaux, Nicolas Veyrat-Charvillon, Francesco Regazzoni.CompactFPGA implementations of the five SHA-3 finalists. ECRYPT2Hash Workshop 2011
  Main result: implementation of BLAKE-512 on Virtex 6and Spartan 6 FPGA devices
  
  
• 2011 May 19: Xu Guo, Meeta Srivastav, Sinan Huang, Leyla Nazhandali, Patrick Schaumont.Siliconimplementation of SHA-3 finalists: BLAKE, Grostl, JH, Keccak andSkein. ECRYPT2 Hash Workshop 2011
  Main result: implementation of BLAKE-256 on 130 nm ASIC
  
  
• 2011 May 12: Miroslav Knežević, Kazuyuki Kobayashi, Jun Ikegami,Shin’ichiro Matsuo, Akashi Satoh, Ünal Kocabas¸Junfeng Fan, ToshihiroKatashita, Takeshi Sugawara, Kazuo Sakiyama, Ingrid Verbauwhede, KazuoOhta, Naofumi Homma, Takafumi Aoki.Fairand consistent hardware evaluation of fourteen round two SHA-3candidates. IEEE T VLSI
  Main result: implementations of BLAKE-32 on Virtex 5and on 90 nm ASIC
  
  
• 2010 Dec 1: Simon Hoerder, Marcin Wojcik, Stefan Tillich, DanPage.An evaluation ofhash functions on a power analysis resistant processorarchitecture. IACR ePrint archive, report 2010/614
  Mainresult: implementation of BLAKE-32 on the Power-Trustplatform
  
  
• 2010 Aug 23: Luca Henzen, Jean-Philippe Aumasson, Willi Meier,Raphael C.-W. Phan.VLSIcharacterization of the cryptographic hash functionBLAKE. IEEE T VLSI
  Main result: variousimplementations of BLAKE-32 and BLAKE-64 on 90, 130, and 180 nmtechnology
  
  
• 2010 Aug 23: Stefan Tillich, Martin Feldhofer, Mario Kirschbaum,Thomas Plos, Jörn-Marc Schmidt, AlexanderSzekely.Uniformevaluation of hardware implementations of the round-two SHA-3candidates. Second SHA-3 Conference
  Main result:implementation of BLAKE-32 on 0.18 µm technology in 38.9 kGE andachieving a throughput of 3.355 Gbps
  
  
• 2010 Aug 23: Xu Guo, Sinan Huang, Leyla Nazhandali, PatrickSchaumont.Fairand comprehensive performance evaluation of 14 second round SHA-3 ASICimplementations. Second SHA-3 Conference
  Mainresult: implementation of BLAKE-32 on 0.13 µm technologyin 30.4 kGE (resp. 43.5 kGE) and achieving a throughput of 196 Mbps(resp. 845 Mbps)
  
  
• 2010 Aug 23: Brian Baldwin, Neil Hanley, Mark Hamilton, Liang Lu,Andrew Byrne, Maire O’Neill, WilliamP. Marnane.FPGA implementations of the round two SHA-3 candidates. Second SHA-3 Conference
  Main result:implementations of BLAKE-32 (resp. BLAKE-64) on a Virtex 5 FPGA devicewith 1118 (resp. 1718) slices and achieving a throughput of 1169 Mbps(resp. 1299 Mbps)
  
  
• 2010 Aug 23: Shin'ichiro Matsuo, Miroslav Knežević, PatrickSchaumont, Ingrid Verbauwhede, Akashi Satoh, Kazuo Sakiyama, KazuoOta.How can we conduct "fair and consistent" hardware evaluation for SHA-3candidate?. Second SHA-3 Conference
  Main result:implementations of BLAKE-32 on a Virtex 5 FPGA device with3053 slices and achieving a throughput of 2676 Mbps
  
  
• 2010 Aug 23: Kris Gaj, Ekawat Homsirikamol, MarcinRogawski.Comprehensive comparison of hardwareperformance of fourteen round 2 SHA-3 candidates with 512-bit outputsusing field programmable gate arrays. Second SHA-3 Conference
  Main result: implementations of BLAKE-32 on Spartan 3,Virtex 4, Virtex 5, Cyclone II, Cyclone III, Stratix II, and StratixIII FPGA devices; for example on Virtex 5, BLAKE-32 is implementedwith 1871 slices, and achieves a throughput of 2853.9 Mbps
  
  
• 2010 Aug 19: Luca Henzen, Pietro Gendotti, Patrice Guillet, EnricoPargaetzi, Martin Zoller, FrankK. Gürkaynak.Developinga hardware evaluation method for SHA-3 candidates. CHES2010
  Main result: implementation of BLAKE-32 on 0.09µm technology in 16 kGE (resp. 47.5 kGE), and achieving athroughput of 0.452 Gbps (resp. 9.752 Gbps)
  
  
• 2010 Aug 19: Kris Gaj, Ekawat Homsirikamol, MarcinRogawski.Fairand comprehensive methodology for comparing hardware performance offourteen round two SHA-3 candidates using FPGAs. CHES2010
  Main result: implementations of BLAKE-32 onSpartan 3, Virtex 4, Virtex 5, Cyclone II, Cyclone III, Stratix II,and Stratix III FPGA devices; for example on Virtex 5, BLAKE-32 isimplemented with 1851 slices, and achieves a throughput of 2610.6 Mbps
  
  
• 2010 Jul 5: Nicolas Sklavos, ParisKitsos.BLAKEhash function family on FPGA: from the fastest to thesmallest. IEEE ISVLSI 2010
  Main result:implementation of all BLAKE instances on a Virtex 4 FPGA device; forexample BLAKE-32 is implemented with 3101 slices and achieves athroughput of 128 Mbps
  
  
• 2010 Apr 1: Jean-Luc Beuchat, Eiji Okamoto, Teppei Yamazaki.Compact implementations of BLAKE-32 and BLAKE-64 on FPGA. IACR ePrint archive, report 2010/173
  Main result: compact implementations of BLAKE-32 and BLAKE-64 on Spartan 3, Virtex 4, Virtex 5, and Cyclone III FPGA devices; for example on Virtex 5, BLAKE-32 (resp. BLAKE-64) is implemented with 56 (resp 108) slices, and achieves a throughput of 225 (resp. 314) Mbps
  
  
• 2010 Jan 10: Kazuyuki Kobayashi, Jun Ikegami, Shin’ichiro Matsuo, Kazuo Sakiyama, Kazuo Ohta.Evaluation of hardware performance for the SHA-3 candidates using SASEBO-GII. IACR ePrint archive, report 2010/010
  Main result: implementation of BLAKE-32 on the SASEBO-GII FPGA platform with 1660 slices, 1393 slice registers, and 5154 slice LUTs, and achieving a throughput of 487 Mbps
  
  
• 2009 Oct 21: Stefan Tillich, Martin Feldhofer, MarioKirschbaum, Thomas Plos, Jörn-Marc Schmidt, AlexanderSzekely.High-speedhardware implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO,Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD,and Skein. IACR ePrint archive, report 2009/510
  Main result: implementation of BLAKE-32 on 0.18 µm technology in 45.6 kGE, and achieving a throughput of 4 Gbps
  
  
• 2009 Jul 14: Stefan Tillich, Martin Feldhofer, Wolfgang Issovits,Thomas Kern, Hermann Kureck, Michael Mühlberghuber, Georg Neubauer,Andreas Reiter, Armin Köfler, Mathias Mayrhofer.Compact hardwareimplementations of the SHA-3 candidates ARIRANG, BLAKE, Grøstl, andSkein. IACR ePrint archive, report 2009/349
  Main result: implementation of BLAKE-32 on 0.35µm technology in 25 kGE, and achieving a throughput of 15.4 Mbps