Appendix A. Work Comparison with SHA-1 and SHA-256

This section preserves the RFC text for FNV, including FNV primes, offset_basis, endianism, XOR folding, constants, non-cryptographic security guidance, source code, test code, Makefile, and comparisons with SHA-1 and SHA-256.

Original RFC Text

Appendix A.  Work Comparison with SHA-1 and SHA-256

   This appendix provides a simplistic rough comparison of the level of
   effort required to compute FNV-1a, SHA-1 [RFC3174], and SHA-256
   [RFC6234] for short messages -- that is, those less than around 50
   bytes.  Some CPUs may have special instructions or other hardware to
   accelerate certain cryptographic operations, so if performance is
   particularly important for an application, benchmarking on the target
   platform would be appropriate.

   Ignoring transfer of control and conditional tests, and equating all
   logical and arithmetic operations, FNV requires two operations per
   byte: an XOR operation and a multiply operation.

   SHA-1 and SHA-256 are actually designed to accept a bit vector input,
   although almost all computer uses apply them to an integer number of
   bytes.  They both process blocks of 512 bits (64 bytes), and we
   estimate the effort involved in processing a full block.  There is
   some overhead per message to indicate message termination and size.
   Assuming that the message is an even number of bytes, this overhead
   would be 9 bytes for SHA-1 and 17 bytes for SHA-256.  So, assuming
   that the message with that overhead fits into one block, the message
   would be up to 55 bytes for SHA-1 or up to 47 bytes for SHA-256.

   SHA-1 is a relatively weak cryptographic hash function producing a
   160-bit hash.  It has been substantially broken [RFC6194].  Ignoring
   SHA-1's initial setup, transfer of control, and conditional tests,
   but counting all logical and arithmetic operations, including
   counting indexing as an addition, SHA-1 requires 1,744 operations per
   64-byte block or 31.07 operations per byte for a message of 55 bytes.
   By this rough measure, it is a little over 15.5 times the effort of
   FNV.

   SHA-256 is, at the time of publication, considered to be a stronger
   cryptographic hash function than SHA-1.  Ignoring SHA-256's initial
   setup, transfer of control, and conditional tests, but counting all
   logical and arithmetic operations, SHA-1 requires 2,058 operations
   per 64-byte block or 48.79 operations per byte for a message of 47
   bytes.  By this rough measure, it is over 24 times the effort of FNV.

   However, FNV is commonly used for short inputs, so doing a comparison
   of such inputs is relevant.  Using the above comparison method, for
   inputs of N bytes, where N is <= 55 so SHA-1 will take one block, the
   ratio of the effort for SHA-1 to the effort for FNV will be 872/N.
   For inputs of N bytes, where N is <= 47 so SHA-256 will take one
   block, the ratio of the effort for SHA-256 to the effort for FNV will
   be 1029/N.  Some examples are given below.

      +=========+==========+=======================+================+
      | Example |   Length | SHA-1 Effort Relative | SHA-256 Effort |
      |         | in Bytes |         to FNV Effort |    Relative to |
      |         |          |                       |     FNV Effort |
      +=========+==========+=======================+================+
      | IPv4    |        4 |                   218 |            514 |
      | address |          |                       |                |
      +---------+----------+-----------------------+----------------+
      | MAC     |        6 |                   145 |            171 |
      | address |          |                       |                |
      +---------+----------+-----------------------+----------------+
      | IPv6    |       16 |                    54 |             64 |
      | address |          |                       |                |
      +---------+----------+-----------------------+----------------+

                                  Table 3