3 ms·

> The point this paper is trying to make is that we should be using safety margins based on knowledge rather than perpetuating the numerology that's been in-pla

> The point this paper is trying to make is that we should be using safety margins based on knowledge rather than perpetuating the numerology that's been in-place to-date. Exactly. The point is that a fair A/B speed comparison between competing ciphers should be normalizing both A and B to equivalent security margins. Instead, its been up to each individual cipher designer as to how many extra rounds should be used. That said, I think the paper's point would be clearer if they had written down a complete table of "equivalent margin rounds" holding each of the standards constant. Ie, how many rounds does ChaCha need to have equivalent margin to AES-128 at its specified number of rounds?

mlyle 7y ago
> Exactly. The point is that a fair A/B speed comparison between competing ciphers should be normalizing both A and B to equivalent security margins Assuming that A and B have received an equal amount of cryptanalytic attention and the "best publicly known" attacks represent equal amounts of effort/progress against the algorithm. In practice, we need to overspecify algorithms initially, not knowing what the next 10-50 years of attacks will look like. Maybe 15 years in you go "woops, could have used fewer rounds-- we're holding up much better than I thought," but at that point the parameters are standard and...
- tptacek 7y ago
  Are you suggesting it's going to look a lot different from the previous 45 years? Because the previous 45 years suggest pretty strongly that we do in fact know how to design a block cipher.
  - mlyle 7y ago
    Public knowledge of differential cryptanalysis is younger than 45 years, and was known to NSA 20+ years before its public "discovery" (and known to IBM 15 years before). Multiple finalists in the AES competition (which selected Rijndael) had significant weaknesses found in the decade since, despite receiving relatively little attention (MARS, Serpent).
    - tptacek 7y ago
      Which weaknesses are you referring to? Let's look at them the same way this paper looks at attacks on AES and Blake2.

mlyle 7y ago

> Exactly. The point is that a fair A/B speed comparison between competing ciphers should be normalizing both A and B to equivalent security margins Assuming that A and B have received an equal amount of cryptanalytic attention and the "best publicly known" attacks represent equal amounts of effort/progress against the algorithm. In practice, we need to overspecify algorithms initially, not knowing what the next 10-50 years of attacks will look like. Maybe 15 years in you go "woops, could have used fewer rounds-- we're holding up much better than I thought," but at that point the parameters are standard and...

tptacek 7y ago
Are you suggesting it's going to look a lot different from the previous 45 years? Because the previous 45 years suggest pretty strongly that we do in fact know how to design a block cipher.
- mlyle 7y ago
  Public knowledge of differential cryptanalysis is younger than 45 years, and was known to NSA 20+ years before its public "discovery" (and known to IBM 15 years before). Multiple finalists in the AES competition (which selected Rijndael) had significant weaknesses found in the decade since, despite receiving relatively little attention (MARS, Serpent).
  - tptacek 7y ago
    Which weaknesses are you referring to? Let's look at them the same way this paper looks at attacks on AES and Blake2.