3 ms·
None of our block cipher or hash function primitives have unconditional security proofs; a lot of the reason to accept them is that the best-known attacks again
by schoen 4y ago
None of our block cipher or hash function primitives have unconditional security proofs; a lot of the reason to accept them is that the best-known attacks against the widely-used ones are very poor, even after a lot of knowledgeable people have studied them for a long time. But that doesn't logically exclude the possibility that there are unknown mathematical insights that would lead to much more effective attacks.
Often, protocols or constructions on top of these cryptographic primitives may have proofs that unconditionally reduce their security to the security of the primitives ("breaking this is at least as hard as AES", normally because "if you could break this, you could also break AES"), or in some cases proofs that do this by making only comparatively uncontroversial mathematical assumptions.
This is a good situation to be in, all things considered, and way better than the past, but it's not an ideal situation!