4 ms·
What? Modern cryptography is based on proofs and definitions. Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that
by Ar-Curunir 9y ago
What? Modern cryptography is based on proofs and definitions. Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks.
Furthermore, assuming certain properties are satisfied by SHA2, we can order that different constructions based on it (eg a Merkle tree) are secure.
Cryptography is highly mathematical.
- mikeash 9y agoI’m talking about proofs that the stuff works, i.e. that the algorithms or code are cryptographically strong. As far as I know, only the one-time pad has such a proof.
- Ar-Curunir 9y agoAs I said, proving that the underlying crypto is unbreakable would involving proving statements stronger than P≠NP, and so isn't going to happen for a while. What you can do is conjecture that your favourite hardness assumption (SHA-256 is a CRH, AES is a PRF, factorisation is not in P) holds, and then base your cryptographic constructions off such assumptions.
- mikeash 9y agoI understand that. Starting with a conjecture and "proving" your algorithm's security based on that is not actually a solid proof. This is why things are the way I said they are.
- cycrutchfield 9y ago>Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Under very carefully chosen assumptions, which may or may not be true (hello Random Oracle). But this is a very flimsy sort of proof.