3 ms·
These slides from 2015 [1] detail some of the rationale that went into designing these functions. Specifically, slide 13 says these 'Domain Separated' function
by niftich 10y ago
These slides from 2015 [1] detail some of the rationale that went into designing these functions.
Specifically, slide 13 says these 'Domain Separated' functions are "completely unrelated", ie. they can't be computed from each other. According to them "this should make it a little harder to shoot yourself in the foot with these functions".
It appears the designers are realizing that assembling crypto building blocks in ways that remain secure and make sense is difficult, so they're providing ready-made versions made for specific uses.
[1] http://csrc.nist.gov/news_events/cif_2015/research/day1_research_200-250pt1.pdf http://csrc.nist.gov/news_events/cif_2015/research/day1_rese...
- tptacek 10y agoTwo interesting bits of context: * Being usable in a straightforward way as a MAC --- something SHA-2 isn't, like MD5 and SHA-1 --- was one of the design criteria for the SHA-3 contest. * This is also part of a heartening trend in crypto research towards "misuse-resistant" cryptography. The "misusers" in MR crypto are... wait for it... application developers. :) A good example of a crypto primitive designed specifically for misuse resistance is Rogaway's SIV mode, which is making a comeback in GCM-SIV. The most popular example of misuse-resistant crypto is of course the Nacl/Sodium library.