5 ms·
> it should be based on completely different underlying mathematics Wasn't that shoe-horned in at the end? There were no requirements that it not be e.g. ARX b
by floody-berry 13y ago
> it should be based on completely different underlying mathematics
Wasn't that shoe-horned in at the end? There were no requirements that it not be e.g. ARX based, or AES based, etc. It wasn't until the final round that any choices were made based on being as alien as possible, where BLAKE's equal security margin and B+/A+ hardware/software performance was tossed out for Keccak's A+/D-.
Also of interest is that DJB's CubeHash was widely panned during the competition for having the exact same "weakened preimage in exchange for performance" tradeoff that is now being made for Keccak.
- duaneb 13y agoWell of course they want you to use hardware encryption, much easier to backdoor more or less invisibly.
- AnthonyMouse 13y agoAlso provides a significant performance advantage to attackers with custom hardware.
- nullc 13y agoThe weird thing for me is that I predicted skein would not be selected on the basis of it being the only finalist without the full 2x output capacity (which was a NIST requirement that DJB had bucked, and was part of the reasons cubehash had bee removed), I was so confidence in this that I bet money on it and won. :P