4 ms·

It didn't make any sense to me to replace a reasonable hash algorithm with one that was, in a technical and eventually (given Grover & Brassard) a practical sen

It didn't make any sense to me to replace a reasonable hash algorithm with one that was, in a technical and eventually (given Grover & Brassard) a practical sense, worse. Keccak's software performance was not top of the pack; c=2n would still not have beaten Skein or BLAKE, let alone BLAKE2. Prudence dictated standardising the parameters that had actually been analysed, rather than changing them after the race was won.

pbsd 12y ago
The quantum scenario is not particularly applicable here. Generic preimage attacks on sponges are essentially collision-finding on the capacity. Grover does not beat classical algorithms at this; Brassard-Høyer-Tapp doesn't either, if you take into account the full cost of the algorithm. In any case, having a c = 512 ceiling for the capacity would put every attack at over 2^256 cost, which presumably is enough, and would keep the function reasonably fast. Note that c = 2n would have rivaled Skein and possibly BLAKE in terms of speed. As for analysis, what matters is the analysis performed on the permutation. The permutation was not touched, and touching that would indeed raise alarms.
- AlyssaRowan 12y ago
  It depends on the chip you use, and the implementation; it would have rivalled Skein (due to the 80 rounds) but BLAKE was faster, and BLAKE2 is faster still.
tveita 12y ago
I think the proposed changes were a bad idea for political reasons, and arguably for technical reasons as well, but the controversity for the internet at large seems to stem from an insinuation that the changes were done to make it possible for the NSA to break SHA-3, and I suspect that is why this was submitted to HN. In that sense I think this is overblown. I don't think anyone thinks NSA has a preimage attack that works for 256 bits capacity but not 512 bits. This is an argument over performance vs. future-proofing that should be fairly boring to non-cryptographers.

pbsd 12y ago

The quantum scenario is not particularly applicable here. Generic preimage attacks on sponges are essentially collision-finding on the capacity. Grover does not beat classical algorithms at this; Brassard-Høyer-Tapp doesn't either, if you take into account the full cost of the algorithm. In any case, having a c = 512 ceiling for the capacity would put every attack at over 2^256 cost, which presumably is enough, and would keep the function reasonably fast. Note that c = 2n would have rivaled Skein and possibly BLAKE in terms of speed. As for analysis, what matters is the analysis performed on the permutation. The permutation was not touched, and touching that would indeed raise alarms.

AlyssaRowan 12y ago
It depends on the chip you use, and the implementation; it would have rivalled Skein (due to the 80 rounds) but BLAKE was faster, and BLAKE2 is faster still.

tveita 12y ago

I think the proposed changes were a bad idea for political reasons, and arguably for technical reasons as well, but the controversity for the internet at large seems to stem from an insinuation that the changes were done to make it possible for the NSA to break SHA-3, and I suspect that is why this was submitted to HN. In that sense I think this is overblown. I don't think anyone thinks NSA has a preimage attack that works for 256 bits capacity but not 512 bits. This is an argument over performance vs. future-proofing that should be fairly boring to non-cryptographers.