4 ms·
Interesting they both say "Official Sha3" and "by its designers", which as I remember it isn't that accurate. Keccak was chosen and then NIST added what is affe
by aliqot 4y ago
Interesting they both say "Official Sha3" and "by its designers", which as I remember it isn't that accurate. Keccak was chosen and then NIST added what is affectionately known as the 'mystery padding' before certification. What we know as official is not the way the designers submitted the proposal.
This isn't an attempt at a scary accusation, but as a pedant, this got me.
For those wondering, here is an explanation by a commenter:
The padding change is the only difference, this allows future tree hashing modes as well as the current SHAKE outputs to generate different digests given the same security parameters and message inputs. Up to 4 additional bits are added, which keeps the full padding inside a byte boundary, making implementations with octet only input able to switch to SHA-3 from Keccak with change to only a single line of code.
https://crypto.stackexchange.com/questions/10645/are-nists-changes-to-keccak-sha-3-problematic https://crypto.stackexchange.com/questions/10645/are-nists-c...
https://cdt.org/insights/what-the-heck-is-going-on-with-nist%E2%80%99s-cryptographic-standard-sha-3/ https://cdt.org/insights/what-the-heck-is-going-on-with-nist...
ketccak team's response: https://keccak.team/2013/yes_this_is_keccak.html https://keccak.team/2013/yes_this_is_keccak.html
- encryptluks2 4y ago
- tptacek 4y agoYou're responding to a post that links to the Keccak designers saying that the padding change isn't nefarious. You have to be able to do better than "NIST bad" in comments on threads like these.
- aliqot 4y agoFrom Daniel J. Bernstein: 2022.08.05: NSA, NIST, and post-quantum cryptography: Announcing my second lawsuit against the U.S. government. : https://blog.cr.yp.to/20220805-nsa.html https://blog.cr.yp.to/20220805-nsa.html https://twitter.com/hashbreaker/status/1555625577989541888 https://twitter.com/hashbreaker/status/1555625577989541888
- tptacek 4y ago... is a FOIA lawsuit about the recent PQ contest they refereed that has literally nothing to do with SHA3.
- jbirer 4y agoAppeal to Authority is not a very good argument either.
- tptacek 4y agoIt is in this case. Absent any argument other than "I don't trust NIST", the designers of Keccak can refute your comment by simply saying "no, this is fine", and that's what they did.
- kelnos 4y agoThat's a bit of a stretch. I think the person who initially designed something signing off on a modification of that something is pretty compelling.
- nullc 4y agoWho actually wrote the faulty code? I had the impression that the padding change was written by the keccak team at the request of NIST.
- tptacek 4y agoThe Keccak team wrote XKCP, for whatever that's worth.
- aliqot 4y agoKeccak for xkcp and NIST for the padding, as far as I can remember. As I recall the padding was added first, and the explanation came later. There was great distrust at first during this time as a result, hence the name 'mystery padding' we used.
- baby 4y agoI'm not sure what's your point, the XKCP is the official SHA-3 implementation.
- aliqot 4y ago> I'm not sure what's your point You're just a baby. There's time.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]