4 ms·
Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement. To quote Wikipedia: >BLAKE2 removes addition of constants to message words
by maqp 5y ago
Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement.
To quote Wikipedia:
>BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).
https://en.wikipedia.org/wiki/BLAKE_(hash_function)#BLAKE2 https://en.wikipedia.org/wiki/BLAKE_(hash_function)#BLAKE2
Reducing the rounds by 4 might raise eyebrows wrt security, but Aumasson's 'Too Much Crypto' discusses BLAKE vs BLAKE2 among other things: https://eprint.iacr.org/2019/1492.pdf https://eprint.iacr.org/2019/1492.pdf
Why kernel devs didn't go with BLAKE3, I can't say.
- giantrobot 5y ago> Why they didn't go with BLAKE3, I can't say. Maybe people just liked it better that way?
- iruoy 5y agoBLAKE3 is written in Rust wile BLAKE2s is written in C. That is probably a lot easier to push through. It also seems to be almost as fast according to the BLAKE3 specs PDF (page 11). https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blak...
- cclearwater 5y agoBLAKE3 has a C implementation including many SIMD implementations. The C implementation only lacks multi-threading which BLAKE2 does not have.
- deleted 5y ago[deleted]
- Pxtl 5y agoGiantrobot was going for a They Might Be Giants song reference
- UI_at_80x24 5y agoI picked up on that reference too. I was about to type it up when I saw your comment. I think it went over a lot of heads.
- giantrobot 5y agoWell, the singers might be giants after all.
- aidenn0 5y agoTMBG was a cover; It was The Four Lads originally I believe
- deleted 5y ago[deleted]
- kingcharles 5y agoDon't. Think. Posts. Below. Got. Joke.
- its_bbq 5y agoIt's BLAKE2, though BLAKE3 was hopeful, but it just BLAKE2, BLAKE3 got a nope SHA1's a long time gone, that crypto's a slowpoke Why did BLAKE3 and SHA1 get the works? That's nobody's business, even Turks!
- johnisgood 5y agoclaps :D
- loeg 5y agoThanks for the correction.
- Kubuxu 5y agoBlake3 is still quite new (although it is a tested core) so I would say they made the right call. It would only result in small incremental perf improvement due to reduced number of rounds (10 to 7). Majority of Blake3's perf benefit manifests from merkle-tree structure and SIMD processing of multiple input streams at the same time.
- johnisgood 5y ago> Not to nitpick but BLAKE was the SHA3 finalist, not BLAKE2 which is an improvement. To add to this: BLAKE2 is derived from BLAKE only, whereas BLAKE3 is derived from Bao AND BLAKE2. > Why kernel devs didn't go with BLAKE3, I can't say. https://news.ycombinator.com/item?id=29748581 https://news.ycombinator.com/item?id=29748581
- loeg 5y agoYour doubly linked comment (adrian_b’s remark) makes the incorrect assertion that the only reason blake3 is faster than blake2 is parallelism; this is objectively false. Blake3 uses fewer rounds (7x2) of the Chacha primitive than blake2 (10x2). I think tptacek has it right: this thing is used very infrequently (period 300 seconds) and blake2 was already in the kernel, so they just reused it. It’s adequately fast, even if blake3 would be marginally faster.
- johnisgood 5y agoI do not think that he claimed that the reason is performance, but regardless, I gave other reasons besides performance, too, including "blake2 was already in the kernel, so they just reused it". I said: "BLAKE2 is already in the kernel (with tests and everything), while BLAKE3 is not (at all)".
- loeg 5y agoYes, we agree here.