3 ms·
There is more to the story then is in the linked article. DJB contributed Cubehash, which had limited preimage resistance due to some design decisions made for
by wbl 12y ago
There is more to the story then is in the linked article. DJB contributed Cubehash, which had limited preimage resistance due to some design decisions made for speed. This was controversial, and one of the reasons for Cubehash being eliminated. But at the end of the competition, NIST lowered the preimage resistance requirement for the eventual standard to that of Cubehash.
In practice I don't think it would matter: the additional speed of the reduced capacity version would be nice to have. However, many competition entries would look different to take advantage of this.
- B-Con 12y agoAs I recall, this was a significant complaint. If NIST was OK with lowering the security requirements then they should have done it at the outset and examined all the algorithms with that standard. The move itself wasn't shady, it was the timing that raised eyebrows.