Unkeyed cryptographic

Keccak (pre-NIST padding)

Keccak is the sponge construction that won the NIST SHA-3 competition in 2012. Between the winning submission and the final FIPS 202 standard (2015), NIST changed one byte of the padding scheme. The original variant lived on under the name “Keccak” , most famously as Ethereum’s keccak256 precompile , producing different digests from the official SHA-3 family for the same input.

The padding difference

• Keccak (pre-NIST): append 0x01, then zero bits, then 0x80 at the end of the rate block.
• SHA-3 (FIPS 202): append 0x06 (which is 011 in little-endian bit order: domain separator 01 + start of pad 1), zero bits, then 0x80.

Same underlying Keccak-f[1600] permutation. Same sponge structure. Same security. Different output for the same input because the padding bytes differ.

At a glance

Why this matters: Ethereum

Ethereum’s keccak256 opcode (Solidity calls it keccak256(...)) uses the pre-NIST padding because the Ethereum whitepaper was written before FIPS 202 finalized. For any non-empty input, keccak256(x) != sha3_256(x). Many cross-chain bridges and Ethereum-tooling libraries have to be very careful here.

Try it

The multi-algorithm hasherincludes both Keccak-256 and SHA3-256 so the byte-level difference is visible. Try input "" and you’ll see two different 32-byte outputs.

References

• The Keccak team home page
• Ethereum issue discussing the Keccak vs SHA-3 padding distinction
• SHA3-256 · SHAKE