Hash Algorithm 输出 Sizes

Output Length Reference

The output size of a hash function determines its collision resistance, which is at most 2 to the n/2 where n is the output bits. Longer outputs provide more collision resistance but consume more storage. Some functions offer multiple output lengths, letting the caller trade security for size. The block size is the internal compression unit and affects performance on large inputs.

MD5

128-bit output, 512-bit block, broken

not for security

SHA-1

160-bit output, 512-bit block, broken

deprecated

SHA-256

256-bit output, 512-bit block

128-bit collision

SHA-512

512-bit output, 1024-bit block

256-bit collision

SHA3-256

256-bit output, 1088-bit rate (Keccak)

sponge

BLAKE3

256-bit default, extendable via XOF, tree mode

parallel

Block vs Rate

Merkle-Damgard constructions like SHA-2 process data in fixed blocks, while sponge constructions like SHA-3 use a rate parameter that differs from the capacity. The rate determines how many input bytes are absorbed per permutation, and the capacity provides the security level. BLAKE3 uses a tree structure that enables parallelism and arbitrary output length extension. Understanding these internal parameters helps predict performance characteristics.

Truncation Practice

Truncating a hash output to fewer bits is common in protocols that need shorter fingerprints, such as CRC-like checksums with collision resistance. Truncation preserves the preimage resistance up to the truncated length but reduces collision resistance to half the truncated bits. SHA-256/128 denotes SHA-256 truncated to 128 bits. Never truncate by simply dropping bytes without documenting which bytes are kept, as conventions vary.