Ethereum hash functions clash over BLAKE3’s speed and SHA-3’s safety

Ethereum developers are quietly rethinking one of the most basic building blocks of the protocol: which cryptographic hash function should carry the network into its next era. The debate over Ethereum hash functions has resurfaced now that a new proof system called Flock has removed a constraint that once shaped every decision — the need for circuit-friendly designs like Poseidon. With that requirement gone, researchers are comparing SHA-2, SHA-3/Keccak, BLAKE2, BLAKE3 and a non-standard SHA-2 variant on security and speed alone, and the analysis published on the Ethereum Research forum lays out just how different these options look once circuit-friendliness is off the table.

Key takeaways

• Ethereum no longer needs circuit-friendly hashes because Flock, a post-quantum proof system for binary circuits, handles hashing efficiently regardless of the algorithm chosen.
• Hash functions underpin consensus-layer signatures, state-tree construction, zkVM proofs and execution-layer signatures across the protocol.
• SHA-2 is fast but not a true random oracle because of a length-extension weakness; SHA-3 offers a high security margin but runs slower; BLAKE2 and BLAKE3 are faster but carry thinner cryptanalysis records.
• Benchmarks show BLAKE3 is the fastest hash function for long messages, while SHA-3 is the slowest among the major candidates.
• A risk-minimizing ranking places SHA-3 first, BLAKE2s and the SHA-2 variant tied for second and third, with BLAKE3 ranked lower.

Ethereum’s Hash Function Requirements in the Post-Quantum Era

Ethereum‘s hash function choice is no longer constrained by proving-circuit efficiency, which frees engineers to prioritize security and raw speed instead. That shift is the direct result of a new proving architecture entering the picture, and it changes the entire calculus behind selecting cryptographic primitives for the network.

Flock’s Proof System Removes the Circuit-Friendly Hash Constraint

For years, any hash function candidate for Ethereum had to be efficient inside zero-knowledge circuits, which effectively pushed the ecosystem toward algebraic, circuit-friendly designs such as Poseidon. That constraint has now largely disappeared. With the emergence of Flock as a post-quantum proof system built for binary circuits — hashes in particular — Ethereum no longer requires specific circuit-friendly hashes for protocols whose computation needs to be proven. In practice, this means the network can evaluate hash functions on their native merits rather than forcing a compromise between cryptographic soundness and proof-system compatibility.

Key Use Cases: Consensus, State Trees, zkVM Proofs, and Execution Layer

Hash functions remain deeply embedded across Ethereum’s architecture, and their performance touches nearly every layer of the protocol. They matter for consensus-layer signatures using an XMSS variant, for aggregating those signatures through a post-quantum proof system, for building the state tree at the execution layer, and for execution-layer signature schemes such as SPHINCS+. Each of these use cases relies on iterative hashing, where the padding rules and chunk size of the chosen algorithm directly affect real-world performance.

Comparing the Leading Hash Function Candidates

No single candidate wins outright on both security and speed, which is exactly why Ethereum researchers are running a side-by-side comparison instead of settling the question by default. The analysis narrows the field to five options: SHA-2, SHA-3/Keccak, BLAKE2, BLAKE3, and a modified SHA-2 variant.

SHA-2, Its Variant and SHA-3/Keccak: Speed Versus Security Margin

SHA-2 is fast and battle-tested, but it is not a random oracle as-is because of a well-known length-extension vulnerability inherited from its Merkle-Damgard construction. A patched SHA-2 variant fixes the indifferentiability gap while keeping most of the original cryptanalysis intact, though it breaks compatibility with the standard and requires a non-standard initialization value.

SHA-3/Keccak, by contrast, brings a high security margin thanks to its sponge construction, having survived years of cryptanalysis without a practical break. That security comes at a cost: SHA-3’s large internal state makes it notably slower both natively and inside proving circuits compared with SHA-2 and the BLAKE family.

BLAKE2, BLAKE3 and Ethereum’s Keccak Compatibility Question

BLAKE2 ranks among the fastest hash functions available and includes a provably indifferentiable compression function, giving it a formal security backbone that SHA-2 lacks. Its downside is scrutiny: fewer than 10 cryptanalysis papers exist on BLAKE2, far short of the coverage enjoyed by SHA-2 or SHA-3. BLAKE3 pushes performance roughly 40% further by reducing the design from 10 rounds to 7 and altering the internal block cipher operations, but those changes strip away the indifferentiability proof entirely and break compatibility with prior BLAKE2 cryptanalysis, meaning its security has to be reassessed from scratch.

A separate wrinkle affects Ethereum specifically: the network’s implementation of Keccak differs from the standardized SHA-3 in its padding scheme. Both versions are equally secure on their own terms, but they are not interoperable in either direction, which adds a layer of implementation complexity that Ethereum clients have had to work around.

Security, Performance and the Risk-Based Ranking

When security and performance data are placed side by side, the trade-offs become sharper than any single metric suggests. Each candidate protects against collision and preimage attacks differently, and each behaves very differently once real hardware benchmarks enter the picture.

Collision and Preimage Resistance Under Scrutiny

Resistance to collision and preimage attacks is where the cryptanalysis record separates the candidates most clearly. SHA-2’s attacks remain far from practical, leaving a comfortable margin. SHA-3’s design has faced only limited collision and preimage attacks, reinforcing its reputation for a wide security buffer. BLAKE2s has no published collision or near-collision attack on the full hash. BLAKE3’s structure has been probed with fewer cryptanalytic attempts so far, leaving its long-term resistance less thoroughly tested than its older sibling.

Benchmark Results and Where Each Hash Function Ranks

Raw speed tells a very different story than security scrutiny does. On long-message hashing, BLAKE3 is the fastest of the group, while SHA-3 is the slowest among the major candidates tested. That gap illustrates the tension at the heart of the Ethereum cryptographic security debate: the fastest option isn’t the most scrutinized, and the most scrutinized option isn’t the fastest.

Weighing security scrutiny against performance, the risk-minimizing ranking puts SHA-3 in first place, with BLAKE2s and the SHA-2 variant tied for second and third. BLAKE3 lands lower on the list, reflecting its thinner track record of independent cryptanalysis despite strong raw performance. In practice, this framing shows why the choice isn’t purely technical — it’s a bet on how much weight the network places on years of public scrutiny versus how much it values shaving milliseconds off every hash call.

The broader implication is that Ethereum’s post-Poseidon hash decision now hinges less on proving-circuit efficiency and more on how much cryptographic risk the protocol is willing to carry in exchange for speed, a trade-off that will likely keep evolving as BLAKE2 and BLAKE3 attract more independent cryptanalysis over time.

FAQ

Why does Ethereum no longer require circuit-friendly hash functions?

Because the Flock post-quantum proof system for binary circuits eliminates the need for specific circuit-friendly hashes.

What are the main uses of hash functions in Ethereum today?

Hash functions are used for consensus layer signatures, aggregating signatures with post-quantum proofs, building the state tree, zkVM proofs, and execution layer signatures.

How do SHA-2 and SHA-3 compare in Ethereum contexts?

SHA-2 is fast and battle-tested but suffers from length-extension vulnerability, while SHA-3 has a higher security margin but slower native and circuit performance.

What are the main advantages and disadvantages of BLAKE2 and BLAKE3?

BLAKE2 is fast and has provable security components but less cryptanalysis; BLAKE3 is faster but lacks an indifferentiability proof and backward cryptanalysis compatibility.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.