BLAKE is our proposal for SHA-3. BLAKE entirely relies on previously analyzed components: it uses the HAIFA iteration mode and builds its compression function on the ChaCha core function. BLAKE resists generic second-preimage attacks, length extension, and sidechannel attacks. Theoretical and empirical security guarantees are given, against structural and differential attacks. BLAKE hashes on a Core 2 Duo at 12 cycles/byte, and on a 8-bit PIC microcontroller at 400 cycles/byte. In hardware BLAKE can be implemented in less than 9900 gates, and reaches a throughput of 6 Gbps. FHNW, Windisch, Switzerland, jeanphilippe.aumasson@gmail.com ETHZ, Zurich, Switzerland, henzen@iis.ee.ethz.ch FHNW, Windisch, Switzerland, willi.meier@fhnw.ch Loughborough University, UK, r.phan@lboro.ac.uk

SHA-3 proposal BLAKE