3 ms·
Doesn't it provide more protection against possible flaws in Salsa? Also, somewhat related question -- what if Salsa core in scrypt is replaced with BLAKE core
by dchest 15y ago
Doesn't it provide more protection against possible flaws in Salsa?
Also, somewhat related question -- what if Salsa core in scrypt is replaced with BLAKE core (with fewer rounds than in hash), and SHA-2 in PBKDF2 with BLAKE, thus making it possibly smaller (hardware and lines of code). Will this work well?
- cperciva 15y agoDoesn't it provide more protection against possible flaws in Salsa? In a very theoretical sense, yes. But Salsa would need to be very very broken in order for that to matter (hence the "no reason to think" comment). what if Salsa core in scrypt is replaced with BLAKE core (with fewer rounds than in hash), and SHA-2 in PBKDF2 with BLAKE, thus making it possibly smaller (hardware and lines of code). Will this work well? Probably. I proved the security under the random oracle model, but the property I actually need is approximately "can't be iterated fast", which is a far weaker requirement.
- dchest 15y agoThank you for your answers.