6 ms·
True, the symmetric primitives are sort of interchangeable, but I'd like to see how to build an AEAD using hash functions that doesn't require you process the d
by remcob 9y ago
True, the symmetric primitives are sort of interchangeable, but I'd like to see how to build an AEAD using hash functions that doesn't require you process the data twice. I don't think it can be easily done, if at all. It certainly won't do to combine a HMAC with a CTR-mode encryption.
Keccak allows for very simple and efficient implementations of all these primitives.
> H(key ‖ m)
This is insecure for SHA2 (length extension). However, it is secure when done with SHA3. In fact, it's pretty much how you construct a MAC from it, that's how natural it is.
HMAC was invented specifically to deal with the shortcomings of SHA2 and predecessors. For reference, it is H(key ⊕ opad, H(key ⊕ ipad, m)), where opad = 0x5C… and ipad = 0x36…. Compare that with the above and you'll see what I mean with simple and efficient.
- tptacek 9y agoWhy can't you just use a prefix MAC with SHA-2 512/224?
- remcob 9y agoYou can, and you just invented the Sponge construction in the process! :) The key idea is to only expose part of the state to inputs/outputs.
- tptacek 9y agoSure, but SHA-2 512/224 predates SHA-3 and the Sponge construction by, what, a decade and a half? And prefix MACs predate all these things by multiple decades (they just happen to be insecure in full-width-output MD hashes). I don't think the ability to use Keccak as a simple prefix MAC is all that gamechanging. You can hash data once --- and much, much faster --- by using SHA-2.
- ctz 9y agoThis is an example of a wide-pipe hash function, not a sponge.