SHA-3 block sizes / bitrate calculation? Looking into different papers and online documents, I find the following block sizes for SHA-3:


SHA3-224: 1152 Bit
SHA3-256: 1088 Bit
SHA3-384: 832 Bit
SHA3-512: 576 Bit


Somehow I am unable to find (calculate) these numbers from the specifications:


http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
http://keccak.noekeon.org/Keccak-implementation-3.0.pdf


How are these block sizes calculated, respectively where exactly are they specified?
First of all, in the case of SHA-3 we don't call it block size but bitrate.

SHA-3 has been formally defined in FIPS 202 and in its reference manual.


  We define the sponge function denoted by $\operatorname{KECCAK}[r,c]$ by applying the sponge construction as specified in Algorithm 1 with $\operatorname{KECCAK-}\!f[r+c]$, multi-rate padding and the bitrate $r$.
  $$\operatorname{KECCAK}[r,c] = \operatorname{SPONGE}[\operatorname{KECCAK-}\!f[r + c], \mathrm{pad10^∗1}, r]$$


$c$ is the capacity, it defines the security level of the sponge.

The value $b = r + c$ is called the width of the state. It is either $25$, $50$, $100$, $200$, $400$, $800$ or $1600$.


  In the scope of the SHA-3 contest, we proposed the largest permutation, namely $\operatorname{KECCAK-}\!f[1600]$.


So in our cases $b = 1600$.

The notation $\operatorname{SHA3-}\!x(M)$ produces a digest $x$ bits long and has a security claim $d = x$. Without going into details, $d$ can be seen as $c/2$ (see here and here, Chapter 7, page 71).

Therefore in:


$\operatorname{SHA3-224}(M)$, $c = 2\times224 = 448$ and $r = 1600 - c = 1152$
$\operatorname{SHA3-256}(M)$, $c = 2\times256 = 512$ and $r = 1600 - c = 1088$
$\operatorname{SHA3-384}(M)$, $c = 2\times384 = 768$ and $r = 1600 - c = 832$
$\operatorname{SHA3-512}(M)$, $c = 2\times512 = 1024$ and $r = 1600 - c = 576$


Hence:


$\operatorname{SHA3-224}(M) = \operatorname{KECCAK}[1152,448]$ with $\mathit{bitrate} = 1152$
$\operatorname{SHA3-256}(M) = \operatorname{KECCAK}[1088,512]$ with $\mathit{bitrate} = 1088$
$\operatorname{SHA3-384}(M) = \operatorname{KECCAK}[832,768]$ with $\mathit{bitrate} = 832$
$\operatorname{SHA3-512}(M) = \operatorname{KECCAK}[576,1024]$ with $\mathit{bitrate} = 576$


As the speed of the algorithm is directly related to $r$ (bit rate absorption), the higher the security, the slower the function will be.