3 ms·
> but I worry that this reduces the security margin. Maybe those extra 3 rounds aren't useful against current attacks, but they may be useful against unknown fu
by zokier 7y ago
> but I worry that this reduces the security margin. Maybe those extra 3 rounds aren't useful against current attacks, but they may be useful against unknown future attacks.
This was covered in more detail in previous "Too Much Crypto" paper [1], which argued that many standards have excessively high round counts. Note that Aumasson is author of both Blake3 and Too Much Crypto
[1] https://news.ycombinator.com/item?id=21917505 https://news.ycombinator.com/item?id=21917505
- labawi 7y agoFrom paper: > Our goal is to propose numbers of rounds for which we have strong confidence that the algorithm will never be wounded They take algorithms, past 10 years of public crypto research and shave off rounds, until it just about starts falling apart. AFAIU having security-reducing attacks is the target. I prefer to have ample confidence in my crypto algorithms. Would not recommend BLAKE3 (without those extra rounds).