CryptoJS Sha3 and PHP-SHA3

Question

I'm trying to get the same result from using cryptojs sha3 method and the php-sha3 library, but the results just dont' seem to match.

An example:

For CryptoJS

var hash = CryptoJS.SHA3("qwerty", { outputLength: 224 }).toString();

gives me d7a12ecec4442f1b31eea5f7d5470f0ca6169463e09d91a147c3b8e8

while with PHP-SHA3

echo sha3("qwerty",224);

gives me 13783bdfa4a63b202d9aa1992eccdd68a9fa5e44539273d8c2b797cd

I am a complete encryption noob, so I'm guessing I'm missing something fundamental about this.

I've read something about SHA-3 being implemented in CryptoJS before it was finalized. It may produce different results. — Artjom B., Apr 15 '16 at 21:50
Just out of interest where are you getting sha3 from for PHP — RiggsFolly, Apr 15 '16 at 21:54
@RiggsFolly got it from https://github.com/strawbrary/php-sha3 — Ting Sun, Apr 15 '16 at 21:59
By the way, you could verify your sha3 value online from https://fe-tool.com/en-us/hash/sha3?inputText=qwerty — cwtuan, Oct 11 '22 at 16:22

Claud · Answer 1 · 2017-05-06T14:10:58.370

CryptoJS 'sha3' is not actually using the current SHA-3 standard unfortunately - hence your discrepancy. The code is implementing a version of SHA-3 which was superseded.

In 2014, NIST made slight changes to the Keccak submission and published FIPS 202, which became the official SHA-3 standard in August 2015.

Quoted from this source:

https://medium.com/@ConsenSys/are-you-really-using-sha-3-or-old-code-c5df31ad2b0

Which goes on to say:

Unfortunately, the readme in Github makes no mention, and the user must look at the old site to find the “NOTE: I made a mistake when I named this implementation SHA-3. It should be named Keccak.” So any dependents of CryptoJS that uses sha3 is using old code that would be better described by a term like Keccak. Also, beware of online sha3 calculators, because some of them have not been updated to SHA-3.

score 1 · Answer 2 · answered Apr 19 '16 at 08:22

1

Artjom is right. You can try this JS library, https://github.com/emn178/js-sha3. I am able to use it to generate SHA3 and Keccak hashes.

The you can verify the hash at http://emn178.github.io/online-tools/sha3_224.html.

answered Apr 19 '16 at 08:22

user3390906

147
1
3
12

Used also with good results. – statosdotcom May 07 '22 at 15:47

CryptoJS Sha3 and PHP-SHA3

2 Answers2