[indolering]

These Keccak derived hashes are my personal favorite hashes. The Keccak sponge function is a more advanced mathematical foundation of hashing than what we had before. The individual mixing functions were also carefully chosen to do very different things. My favorite attribute, however, is that all the cryptanalysis done on SHA3 maps directly to Keccak (unlike Blake's follow-ons).

[coppsilgold]

Unfortunately a state of 25 64-bit words isn't likely get CPU intrinsics anytime soon.

[adrian_b]

That is less than 4 of the 32 software-visible vector registers of an AMD Zen 4 or Zen 5 CPU, or of the future Intel CPUs that will reintroduce AVX-512.

There is no difficulty in defining AVX-512 instructions that would operate on a hash state of this size.

The real amount of 64-bit registers in a modern CPU is well above one thousand and the implementation of the SHA-3 functions is very efficient in hardware, so adding instructions for these hashes would have a very modest cost.

[indolering]

Keccak is core to the SHA3 standard. If speed is a concern, there are hand tuned assembly versions and hardware implementations out there.