3 ms·
As a participant in the SHA hash function contest who broke one of the 51 Round-1 SHA-3 proposals and who worked on security proofs for another SHA-3 proposal I
by KKKKkkkk1 9y ago
As a participant in the SHA hash function contest who broke one of the 51 Round-1 SHA-3 proposals and who worked on security proofs for another SHA-3 proposal I can say with some authority that using the sponge construction and showing statistical properties of the transformation function is not sufficient to ensure security. Of the 51 Round-1 SHA-3 proposals all of them passed statistical tests and at least one round of
review by NIST yet 33/51 were broken.
A more general point is that you should never roll your own crypto and if you must then it should be submitted for peer review by cryptographers before using it in a security critical application.
I know this is a pretty standard way to carry a technical conversation in the crypto community, but this is a pure and unadulterated argument from authority. I don't think other fields of computer science get away with this bullshit (you can't invent anything new unless you get a blessing from "the community").
- mikeash 9y agoThat’s because other fields of computer science can either prove or demonstrate that their solution works. Cryptography almost never has solid proofs, and demonstrations prove nothing. When you’re working on something where “works great” and “completely broken” are almost indistinguishable, the only way to even have a hope of avoiding the second one is by having a lot of smart people bang on it for a long time.
- Ar-Curunir 9y agoWhat? Modern cryptography is based on proofs and definitions. Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Furthermore, assuming certain properties are satisfied by SHA2, we can order that different constructions based on it (eg a Merkle tree) are secure. Cryptography is highly mathematical.
- mikeash 9y agoI’m talking about proofs that the stuff works, i.e. that the algorithms or code are cryptographically strong. As far as I know, only the one-time pad has such a proof.
- Ar-Curunir 9y agoAs I said, proving that the underlying crypto is unbreakable would involving proving statements stronger than P≠NP, and so isn't going to happen for a while. What you can do is conjecture that your favourite hardness assumption (SHA-256 is a CRH, AES is a PRF, factorisation is not in P) holds, and then base your cryptographic constructions off such assumptions.
- mikeash 9y agoI understand that. Starting with a conjecture and "proving" your algorithm's security based on that is not actually a solid proof. This is why things are the way I said they are.
- cycrutchfield 9y ago>Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Under very carefully chosen assumptions, which may or may not be true (hello Random Oracle). But this is a very flimsy sort of proof.
- strictnein 9y agoYou may dislike the listing of authority, but he's right, and you're kind of misconstruing what he's saying. You can "invent" all the crypto systems you want, you're just foolish to do so without proper review, because there will be flaws.
- mbgaxyz 9y agoIn a later response, IOTA also appeal to authority... > Did you receive the invite? We can also setup a chat with our ex-NSA post-Quantum hash function experts after we get the initial confusion out of the way.
- EthanHeilman 9y ago"Of the 51 Round-1 SHA-3 proposals all of them passed statistical tests and at least one round of review by NIST yet 33/51 were broken." My central point is that statistical tests are not in anyway sufficient for showing the security of a cryptographic hash function since it is easy to create a hash function that passes them and is broken. My evidence was the SHA-3 competition.