Unkeyed cryptographic
Keccak (pre-NIST padding)
Keccak is the sponge construction that won the NIST SHA-3 competition in 2012. Between the winning submission and the final FIPS 202 standard (2015), NIST changed one byte of the padding scheme. The original variant lived on under the name “Keccak” , most famously as Ethereum’s keccak256 precompile , producing different digests from the official SHA-3 family for the same input.
The padding difference
- Keccak (pre-NIST): append
0x01, then zero bits, then0x80at the end of the rate block. - SHA-3 (FIPS 202): append
0x06(which is011in little-endian bit order: domain separator01+ start of pad1), zero bits, then0x80.
Same underlying Keccak-f[1600] permutation. Same sponge structure. Same security. Different output for the same input because the padding bytes differ.
At a glance
| Common variants | Keccak-224 / 256 / 384 / 512 |
|---|---|
| State | 1600 bits (5×5×64) |
| Rounds | 24 (same as SHA-3) |
| Length extension | No (sponge) |
| Status | Cryptographically equivalent to SHA-3; non-NIST padding |
Why this matters: Ethereum
Ethereum’s keccak256 opcode (Solidity calls it keccak256(...)) uses the pre-NIST padding because the Ethereum whitepaper was written before FIPS 202 finalized. For any non-empty input, keccak256(x) != sha3_256(x). Many cross-chain bridges and Ethereum-tooling libraries have to be very careful here.
Try it
The multi-algorithm hasherincludes both Keccak-256 and SHA3-256 so the byte-level difference is visible. Try input "" and you’ll see two different 32-byte outputs.
References
- The Keccak team home page
- Ethereum issue discussing the Keccak vs SHA-3 padding distinction
- SHA3-256 · SHAKE
Visualize
Keccak-256 on your input
11 bytes · 0-bit digest
Hex digest
Bit grid (0 bits, teal = 1, slate = 0)
Byte pixel art (0 bytes, hue = byte value mod 360°)
Avalanche , flipping the lowest bit of the first input byte changed 0 of 0 output bits
Quick quiz
Test yourself on keccak
10 multiple-choice questions. Pick an answer for each, then submit to see explanations.
Q1.How does Keccak's pre-NIST padding differ from SHA-3?
Q2.Which blockchain uses Keccak-256 (not SHA-3-256)?
Q3.Underlying permutation of both Keccak and SHA-3:
Q4.Length-extension on Keccak?
Q5.If you hash empty input, do Keccak-256 and SHA3-256 differ?
Q6.Was Keccak the original SHA-3 competition submission?
Q7.Number of Keccak-f rounds:
Q8.State size of Keccak-f[1600]:
Q9.Number of sub-steps per Keccak-f round:
Q10.Which Wikipedia family does Keccak belong to?