3 ms·
Shots fired. Here's an tweet from Jean-Philippe Aumasson, one of the authors of BLAKE(2) (uses ChaCha ARX construction) and NORX (uses modified ChaCha replacin
by dchest 9y ago
Shots fired.
Here's an tweet from Jean-Philippe Aumasson, one of the authors of BLAKE(2) (uses ChaCha ARX construction) and NORX (uses modified ChaCha replacing addition with an approximation based on XOR, AND, shift operations):
"where @KeccakTeam misses a big point: MD5 and SHA-1 got broken because of Boolean operations (AND/OR), not because of ARX operations" https://twitter.com/veorq/status/910255284920180736 https://twitter.com/veorq/status/910255284920180736
- projectant 9y agoOk but, in reply to that tweet, one point keccak.team make, which seems valid for non-classified cryptanalysis, is that researchers don't invest time in trying to analyse ARX because the propagation of addition makes it too complicated. One thing I got from that is that ARX designs are less likely to be broken, not because they are necessarily more secure, but because ARX is often less analysed than designs which yield more concise mathematical representations.
- gcp 9y agoI think there's an implication here of "less likely to be broken by public research".
- mfukar 9y agoThat would be getting causality backwards.
- gcp 9y agoI have no idea what you mean.
- SkyMarshal 9y agoExactly, ARX's less analyzed complexity is a potential information asymmetry arbitrage for serious attackers.
- Confiks 9y agoShots fired indeed, although the 132-character argument is a bit of a straw man; the original argument was that using ARX operations in cryptographic primitives makes it harder to analyze the primitive, regardless of whether the actual weakness is in a boolean or an ARX operation.
- npscalar 9y agoAgreed. No contradiction. keccak.team does not say ARX is broken, only harder to analyze (and slow in HW, and getting obsoleted).
- raverbashing 9y agoWell, AND and OR "lose information" more than XOR x.0 is 0 and x+1 is 1 (to use combinational logic notation) Now XOR(x,y) depend on x and y and there are no values that cause the other value to be ignored I also think the point they make about speed is kinda picking at straws, it's valid for an FPGA, but not so much for a CPU