3 ms·

Why not increase the rounds then? What makes the current security margins acceptable but not smaller margins?

ganzuul 7y ago
I don't know a reason for why they are acceptable. AES256 is considered quantum-proof, but there exists another theoretical quantum computer design which seems to raise the bar again. I don't know if there exists a theoretical limit for how powerful quantum computers can get.
- bawolff 7y ago
  What other theoretical quantum design? AES256 is considered quantum proof because grover's algorithm can in theory basically half they key size, and aes128 is secure on normal computers [we are still very very very very far away from a quantum computer that can use grover's algorithm to bruteforce aes128]. I'm not an expert on the subject but i believe a new quantum algorithm that could break aes256 would be a very major breakthrough in designing quantum algorithms.
s_tec 7y ago
The basic intuition behind symmetric cryptography is that once your input bits are "thoroughly mixed", there's no way to un-mix them besides brute-force. On the other hand, we don't have a solid theory of computational complexity yet. Even basic questions like P = NP are still unanswered, so we have no idea what "thoroughly mixed" actually means, how to measure it, how to achieve it, or even if it exists. Whatever it is, a single round of BLAKE certainly isn't "thoroughly mixed". Is 10 rounds enough? Nobody knows. On the other hand, we suspect that a thousand rounds are no better than a hundred - there's probably a plateau of "maximum entropy", and once you get there, extra mixing doesn't help. So, since we don't actually know what we are doing, we pick a safety margin, like 1.4x or 2x, and just use that. It's all just guesswork until the theoretical side catches up, so your opinion is as good as mine. On the other hand, picking a safety margin of 1 seems rash. If you have practical attacks in the round before, you probably aren't anywhere near the plateau of maximum entropy!

I don't know a reason for why they are acceptable. AES256 is considered quantum-proof, but there exists another theoretical quantum computer design which seems to raise the bar again. I don't know if there exists a theoretical limit for how powerful quantum computers can get.

bawolff 7y ago
What other theoretical quantum design? AES256 is considered quantum proof because grover's algorithm can in theory basically half they key size, and aes128 is secure on normal computers [we are still very very very very far away from a quantum computer that can use grover's algorithm to bruteforce aes128]. I'm not an expert on the subject but i believe a new quantum algorithm that could break aes256 would be a very major breakthrough in designing quantum algorithms.

s_tec 7y ago

The basic intuition behind symmetric cryptography is that once your input bits are "thoroughly mixed", there's no way to un-mix them besides brute-force. On the other hand, we don't have a solid theory of computational complexity yet. Even basic questions like P = NP are still unanswered, so we have no idea what "thoroughly mixed" actually means, how to measure it, how to achieve it, or even if it exists. Whatever it is, a single round of BLAKE certainly isn't "thoroughly mixed". Is 10 rounds enough? Nobody knows. On the other hand, we suspect that a thousand rounds are no better than a hundred - there's probably a plateau of "maximum entropy", and once you get there, extra mixing doesn't help. So, since we don't actually know what we are doing, we pick a safety margin, like 1.4x or 2x, and just use that. It's all just guesswork until the theoretical side catches up, so your opinion is as good as mine. On the other hand, picking a safety margin of 1 seems rash. If you have practical attacks in the round before, you probably aren't anywhere near the plateau of maximum entropy!