Audience
Researchers & auditors
Specs, empirical campaigns, throughput benches, and the ForgeHash-X sandbox. Green tests are consistency data — not a security proof.
Not production cryptography. Prefer Argon2id, scrypt, bcrypt, or platform password APIs. Matching vectors ≠ reviewed hardness.
Audit path
-
1
Read the B3 specification
Normative
SPECIFICATION.md— domains, ForgeMix, memory fill, encoding, parser rejects. -
2
Pin official vectors
Four frozen B3 digests. Any algorithm break that changes them needs
v=2. -
3
B3 research report
100 000-sample uniqueness campaign, TMTO snapshot, open questions.
-
4
Tooling
Collision Lab, Visualizer, ResearchBench (matched B3/X + peer KDFs).
-
5
Security policy
How to report issues; what “experimental” means for disclosure expectations.
ForgeHash-X sandbox
Clean-sheet track with a custom ForgeX sponge ($forgehx$v=0$). Not B3-compatible.
- SPECIFICATION_X.md
- RESEARCH_NOTES.md — campaigns + matched/peer benches
- Research paper (PDF)
- X toy vectors & ForgeX KATs
Reproduce benches
# Matched-cost B3 vs X (m ≥ 8192 KiB)
dotnet run --project tools/ForgeHash.ResearchBench -c Release -- --suite matched --markdown
# Peer KDFs: bcrypt, Argon2id, scrypt, PBKDF2 (presets ≠ equal work)
dotnet run --project tools/ForgeHash.ResearchBench -c Release -- --suite peers --markdown
# Collision Lab (GUI)
dotnet run --project src/ForgeHash.CollisionLab -c ReleaseWhat “passing” means here
| Signal | Shows | Does not show |
|---|---|---|
| Official vectors | Bit-exact conformance to the published algo | Production safety |
| Large-N uniqueness hunts | No accidental collisions in that sample set | Birthday / adversarial bounds |
| Throughput tables | Wall-clock cost on one machine | ASIC / GPU hardness |