{
 "id": "epgm773abc",
 "slug": "skein-hash-function",
 "title": "Skein (hash function)",
 "updated": "2026-10-25",
 "topic_path": [
  {
   "id": "technology",
   "label": "Technology and the built world",
   "api_url": "https://www.edgepedia.org/api/v1/topics/technology"
  },
  {
   "id": "technology.computing",
   "label": "Computing and digital systems",
   "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing"
  },
  {
   "id": "technology.computing.networks",
   "label": "Networks and security",
   "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.networks"
  },
  {
   "id": "technology.computing.networks.alpha-mo-to-z",
   "label": "Titles Mo to Z",
   "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.networks.alpha-mo-to-z"
  }
 ],
 "geo": [
  {
   "id": "geo.nongeo.t2001.technology.computing.networks",
   "label": "Non-geographic · 2001 to 2020: Networks and security",
   "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t2001.technology.computing.networks",
   "path": [
    {
     "id": "geo.nongeo",
     "label": "Non-geographic",
     "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo"
    },
    {
     "id": "geo.nongeo.t2001",
     "label": "Non-geographic · 2001 to 2020",
     "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t2001"
    },
    {
     "id": "geo.nongeo.t2001.technology",
     "label": "Technology and the built world",
     "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t2001.technology"
    },
    {
     "id": "geo.nongeo.t2001.technology.computing",
     "label": "Computing and digital systems",
     "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t2001.technology.computing"
    },
    {
     "id": "geo.nongeo.t2001.technology.computing.networks",
     "label": "Networks and security",
     "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t2001.technology.computing.networks"
    }
   ]
  }
 ],
 "excerpt": "Skein is a family of cryptographic hash functions built on the Threefish block cipher; it was a SHA-3 finalist, but NIST chose Keccak in 2012.",
 "snippet": "Skein is a family of cryptographic hash functions built on the Threefish block cipher; it was a SHA-3 finalist, but NIST chose Keccak in 2012.",
 "node": "technology.computing.networks.alpha-mo-to-z",
 "markdown": "# Skein (hash function)\n\nSkein is a family of cryptographic hash functions that computes message digests from a tweakable block cipher, Threefish, and was a finalist in NIST's SHA-3 competition. It comes in three internal state sizes, 256, 512, and 1024 bits, and can produce any output size up to \\( 2^{64} \\) bits.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> Skein was selected as one of five SHA-3 finalists on December 9, 2010, but NIST announced Keccak as the competition winner on October 2, 2012.<sup>[2](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)</sup> The design combines three components: the Threefish block cipher, the Unique Block Iteration (UBI) chaining mode, and an optional argument system that supports keys, personalization strings, and other inputs.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup>\n\n| Key fact | Value |\n|---|---|\n| Internal state sizes | 256, 512, and 1024 bits (Skein-512 is the primary proposal)<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> |\n| Building blocks | Threefish tweakable block cipher, UBI chaining mode, optional argument system<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> |\n| Digest length | Any output size up to \\( 2^{64} \\) bits, via the output transform<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> |\n| Specification | Version 1.3, dated 1 October 2010<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> |\n| Designers | Niels Ferguson, Stefan Lucks, Bruce Schneier, Doug Whiting, Mihir Bellare, Tadayoshi Kohno, Jon Callas, and Jesse Walker<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> |\n| Speed (64-bit CPUs) | Skein-512 at 6.1 cycles/byte for a 512-bit hash, versus BLAKE-512 at 8.03 and SHA-2-512 at 12<sup>[3](https://web.archive.org/web/20191013051919/http:/skein-hash.info/sha3-engineering)</sup> |\n| SHA-3 outcome | Finalist (December 9, 2010); Keccak selected instead (October 2, 2012)<sup>[2](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)</sup> |\n\n## How it works\n\nSkein's core idea is to build a hash function out of a tweakable block cipher, a cipher that takes an extra public input, the tweak, alongside the key and plaintext. Threefish is defined for block sizes of 256, 512, and 1024 bits with a 128-bit tweak.<sup>[4](https://www.schneier.com/wp-content/uploads/2016/02/skein-proofs.pdf)</sup> Internally it operates on 64-bit words; the round function is built from the MIX operation, \\( \\mathrm{MIX}(x, y) = (x + y,\\ (x + y) \\oplus \\mathrm{ROTL}(y, R)) \\), an addition, a rotation, and an XOR.<sup>[5](https://www.iacr.org/archive/asiacrypt2009/59120540/59120540.pdf)</sup> Threefish-256 and Threefish-512 hold their state and key as \\( N_{w} = 4 \\) or 8 64-bit words respectively.<sup>[6](https://eprint.iacr.org/2010/538.pdf)</sup>\n\nThe tweak is what turns this cipher into a hash. Because the tweak is hashed into every block, each invocation of the compression function is unique, and configuration data is processed along with the message text.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> The compression function \\( \\mathrm{TComp} \\) is obtained by running Threefish in Matyas-Meyer-Oseas mode, and the UBI chaining mode iterates it over the input.<sup>[4](https://www.schneier.com/wp-content/uploads/2016/02/skein-proofs.pdf)</sup> The designers' companion paper justifies the provable-security claims by modeling Threefish as an ideal tweakable block cipher \\( E: \\{0,1\\}^{b} \\times \\{0,1\\}^{t} \\times \\{0,1\\}^{b} \\to \\{0,1\\}^{b} \\) with \\( t = 128 \\) and \\( b \\in \\{256, 512, 1024\\} \\).<sup>[4](https://www.schneier.com/wp-content/uploads/2016/02/skein-proofs.pdf)</sup>\n\n## How it is done\n\nA practitioner computing a Skein digest runs three UBI invocations: the configuration block starts from a zero chaining value, message processing chains from the configuration result, and the output transform chains from the message result. The message can be up to \\( 2^{96} - 1 \\) bytes long.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup>\n\n1. **Configuration block.** A 32-byte configuration string encodes the desired output length and tree-hashing parameters. For standard hashing its UBI result is constant, so it can be precomputed once and stored as an initial value (IV).<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup>\n2. **Message processing.** Each message block is processed with UBI. For Skein-512, a message of \\( b \\) blocks needs \\( b + 1 \\) calls to Threefish in total, including the output transform, when starting from the precomputed configuration value \\( G_{0} \\).<sup>[7](https://eprint.iacr.org/2012/126.pdf)</sup>\n3. **Output transform.** This final UBI call is required to achieve hashing-appropriate randomness, and it lets Skein produce any output size up to \\( 2^{64} \\) bits by using Threefish in counter mode with an 8-byte counter.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup>\n\nSkein also defines an optional hash tree mode with three tunable parameters: the leaf node size, the tree fan-out, and the maximum tree height.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup>\n\n## Origin\n\nThe specification is version 1.3.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> NIST opened the SHA-3 competition, received 64 submissions, selected 51 first-round candidates, 14 second-round candidates, and the five finalists BLAKE, Grøstl, JH, Keccak, and Skein.<sup>[2](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)</sup> In its first-round report, NIST identified the most innovative parts of Skein as the Threefish block cipher and the chaining mode, and noted its good performance on high-end platforms, particularly in 64-bit mode.<sup>[8](https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7620.pdf)</sup> On October 2, 2012, NIST announced Keccak as the winner, so Skein finished as a finalist but was not standardized as SHA-3.<sup>[2](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)</sup>\n\n## Variants\n\n**Three state sizes, three roles.** Skein-512 is the primary proposal, judged safe for all current hashing applications. Skein-1024 is an ultra-conservative variant that can run nearly twice as fast as Skein-512 in dedicated hardware. Skein-256 is the low-memory variant, implementable in about 100 bytes of RAM.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> For the SHA-3 use cases, the submission proposed skein512_256 for SHA-3-256 and skein512_512 for SHA-3-512, even though skein512_256 consumes about twice the space of skein256_256.<sup>[9](https://csrc.nist.rip/groups/ST/hash/sha-3/Round3/March2012/documents/papers/BERNSTEIN_paper.pdf)</sup>\n\n**Optional arguments and MAC.** The optional argument system accepts, in order, a key (turning Skein into a MAC or KDF), the required configuration block, a personalization string, a public key, a key-derivation identifier, and a nonce; plain Skein hashing is Skein-MAC with a null key.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> Skein-MAC has zero per-message overhead, whereas [HMAC](https://www.edgepedia.org/hmac) requires at least two hash computations per authentication, and the configuration-block output can be precomputed per key for faster short-message MACing.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> Skein-PRNG can produce random data at the same speed it hashes data, with small requests requiring a minimum of two Threefish encryptions.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup>\n\n## Applications\n\nOn an Intel Core 2 Duo in 64-bit assembly, Skein-256, Skein-512, and Skein-1024 hash large messages at 7.6, 6.1, and 6.5 clocks per byte respectively.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> At 6.1 clocks/byte, Skein-512 in C is more than twice as fast as SHA-512's 13.3 clocks/byte on the NIST reference platform CPU.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> A cross-candidate engineering comparison gives similar relative figures: 6.1 cycles/byte for Skein-512 on 64-bit code versus BLAKE-512 at 8.03 and SHA-2-512 at 12, and 7.6 for Skein-256 versus BLAKE-256 at 8.03 for 256-bit hashes.<sup>[3](https://web.archive.org/web/20191013051919/http:/skein-hash.info/sha3-engineering)</sup> In hardware, a compact Skein-512-512 coprocessor prototyped on a [Xilinx Virtex](https://www.edgepedia.org/xilinx-virtex)-6 FPGA reaches a throughput converging asymptotically to 160 Mbits/s for large messages.<sup>[7](https://eprint.iacr.org/2012/126.pdf)</sup>\n\nSkein remains available in several software libraries. Bouncy Castle implements Skein version 1.3 in 256, 512, and 1024-bit block sizes based on Threefish, with arbitrary output size in 1-byte intervals and the parameter-based configuration system; the code underlies the SkeinDigest and SkeinMac classes.<sup>[10](https://downloads.bouncycastle.org/lts-java/docs/bcprov-lts8on-2.73.5-javadoc/org/bouncycastle/crypto/digests/SkeinEngine.html)</sup> PySkein exposes Skein-256, Skein-512, and Skein-1024 hash objects with a configurable digest length in bits (must be < \\( 2^{31} \\)).<sup>[11](https://pythonhosted.org/pyskein/skein.html)</sup> The Haskell skein package provides hashing and Skein-MAC, recommending Skein_512_512 by default.<sup>[12](https://hackage.haskell.org/package/skein-1.0.9.4/docs/Crypto-Skein.html)</sup>\n\n## Limitations and alternatives\n\nSkein's design is backed by security proofs for the UBI mode and the compression function, under the ideal-tweakable-block-cipher assumption for Threefish.<sup>[4](https://www.schneier.com/wp-content/uploads/2016/02/skein-proofs.pdf)</sup> The first third-party analysis, published in 2009, presented near collisions, impossible differentials, and related-key boomerang distinguishers on reduced-round Threefish, together with key recovery attacks on up to 32 of Threefish-512's 72 rounds; none of these attacks directly extends to the full Skein hash, and the authors concluded that at least 36 rounds of Threefish seem required for optimal security guarantees.<sup>[5](https://www.iacr.org/archive/asiacrypt2009/59120540/59120540.pdf)</sup> Differential and rotational cryptanalysis led the designers to tweak the design twice, and the rotational property that penetrated the most rounds no longer exists in the final-round version; after the tweaks, the best known attacks are near-collisions on up to 24 rounds of the compression function.<sup>[13](https://eprint.iacr.org/2011/286.pdf)</sup> ECRYPT's summary table records collisions on 12 rounds of Skein-256 (\\( 2^{126.5} \\) compression function calls) and 14 rounds of Skein-512 (\\( 2^{254.5} \\) calls), and a preimage attack on 22 rounds of Skein-512 (\\( 2^{511.0} \\) calls with \\( 2^{6} \\) memory).<sup>[14](https://ehash.isec.tugraz.at/wiki/Skein.html)</sup>\n\nThe security of Skein is limited by its internal state size.<sup>[1](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)</sup> Among the finalists, NIST noted that the compression functions of BLAKE and Skein are based on block ciphers, whereas Grøstl's is based on a pair of fixed permutations.<sup>[2](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)</sup> For compact FPGA implementations, hardware authors argued that BLAKE, Keccak, and Skein are the best candidates, with Skein's advantage that the same coprocessor can both encrypt and hash.<sup>[7](https://eprint.iacr.org/2012/126.pdf)</sup> The main practical drawback is the absence of standardization: Keccak became SHA-3, so Skein competes with a standardized alternative and with SHA-2.<sup>[2](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)</sup>\n\n## References\n\n1. [The Skein Hash Function Family (Version 1.3, 1 October 2010)](https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf)\n2. [Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition (NISTIR 7896)](https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf)\n3. [Engineering comparison of SHA-3 candidates (archived)](https://web.archive.org/web/20191013051919/http:/skein-hash.info/sha3-engineering)\n4. [Provable Security Support for the Skein Hash Family](https://www.schneier.com/wp-content/uploads/2016/02/skein-proofs.pdf)\n5. [Improved Cryptanalysis of Skein (Asiacrypt 2009), first third-party cryptanalysis of Threefish](https://www.iacr.org/archive/asiacrypt2009/59120540/59120540.pdf)\n6. [Rotational Rebound Attacks on Reduced Skein](https://eprint.iacr.org/2010/538.pdf)\n7. [Compact Implementation of Threefish and Skein on FPGA](https://eprint.iacr.org/2012/126.pdf)\n8. [Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition (NISTIR 7620)](https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7620.pdf)\n9. [The New SHA-3 Software Shootout (SHA-3 Conference, March 2012)](https://csrc.nist.rip/groups/ST/hash/sha-3/Round3/March2012/documents/papers/BERNSTEIN_paper.pdf)\n10. [SkeinEngine (Bouncy Castle Library LTS Edition 2.73.5 API)](https://downloads.bouncycastle.org/lts-java/docs/bcprov-lts8on-2.73.5-javadoc/org/bouncycastle/crypto/digests/SkeinEngine.html)\n11. [Skein hash, PySkein 1.0 documentation](https://pythonhosted.org/pyskein/skein.html)\n12. [Crypto.Skein (Haskell package skein-1.0.9.4)](https://hackage.haskell.org/package/skein-1.0.9.4/docs/Crypto-Skein.html)\n13. [Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 family](https://eprint.iacr.org/2011/286.pdf)\n14. [Skein - The ECRYPT Hash Function Website](https://ehash.isec.tugraz.at/wiki/Skein.html)\n\n---\n*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Networks and security › Titles Mo to Z*\n\n*Initially written Sep 29, 2026 · Reviewed: Sep 30, 2026 · Edited: Sep 30, 2026; Oct 25, 2026 · Last review: Sep 30, 2026*\n\n*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*\n\nLicense: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license\n",
 "same_as": [],
 "url": "https://www.edgepedia.org/skein-hash-function",
 "markdown_url": "https://www.edgepedia.org/skein-hash-function.md",
 "license": {
  "name": "Edgepedia Community License 1.0",
  "url": "https://www.edgepedia.org/edgepedia/license",
  "summary": "Free with credit, commercial use included. AI training is open to everyone. For other uses, organizations over USD 100M in revenue or 100M monthly users license separately.",
  "spdx": "LicenseRef-Edgepedia-Community-1.0"
 },
 "credit": "\"Skein (hash function)\", Edgepedia (EdgeChat), https://www.edgepedia.org/skein-hash-function. Edgepedia Community License 1.0.",
 "credit_md": "\"[Skein (hash function)](https://www.edgepedia.org/skein-hash-function)\", Edgepedia (EdgeChat), [https://www.edgepedia.org/skein-hash-function](https://www.edgepedia.org/skein-hash-function). [Edgepedia Community License 1.0](https://www.edgepedia.org/edgepedia/license).",
 "credit_html": "\"<a href=\"https://www.edgepedia.org/skein-hash-function\">Skein (hash function)</a>\", Edgepedia (EdgeChat), <a href=\"https://www.edgepedia.org/skein-hash-function\">https://www.edgepedia.org/skein-hash-function</a>. <a href=\"https://www.edgepedia.org/edgepedia/license\">Edgepedia Community License 1.0</a>.",
 "speakable": "Skein is a family of cryptographic hash functions built on the Threefish block cipher; it was a SHA-3 finalist, but NIST chose Keccak in 2012."
}