4 ms·
> After the leaks, however, there was a lot of attention focused on NIST and these changes There were people (myself included) complaining about this to NIST p
by nullc 12y ago
> After the leaks, however, there was a lot of attention focused on NIST and these changes
There were people (myself included) complaining about this to NIST prior to the Snowden leaks.
SHA-256 pre-image == collision resistance property and there are many cryptographic protocols (e.g. hash based signatures) where pre-image security is much more important than collision security, and where the additional size of being forced to switch to a 512-bit hash function would result in burdensome communications overheads, just to keep the same formal security as SHA-256 (while staying in a standard hash function).
There is a lot more complexity in this subject in that some of the candidates chose to not meet the security requirements for these performance reasons (e.g. cubehash) and were rejected for that reason. Had the goal been something with N/2 security across the board all along the designs and choices from all the candidates would have likely been pretty different.
- Perseids 12y agoThere was also the proposal to fix the capacity to c=512 among all output sizes and thus reach a security level of 256bit throughout all instances (given the output size is large enough to support the guarantee). Unfortunately this proposal didn't make it to the draft.
- nullc 12y agoI liked that proposal... I think that probably if not for the Snowden-assisted concerns that proposal would have prevailed. The reduction of pre-image security to 128 bits would be a step backwards compared to sha256, but I think no one was seriously arguing for security levels >256 bit— even assuming QC 256 bits should be adequate against all generic attacks. But once tampering was seriously raised as a concern, doing something as close to the original proposal as possible was much more attractive than other options.