3 ms·
There was also the proposal to fix the capacity to c=512 among all output sizes and thus reach a security level of 256bit throughout all instances (given the ou
by Perseids 12y ago
There was also the proposal to fix the capacity to c=512 among all output sizes and thus reach a security level of 256bit throughout all instances (given the output size is large enough to support the guarantee). Unfortunately this proposal didn't make it to the draft.
- nullc 12y agoI liked that proposal... I think that probably if not for the Snowden-assisted concerns that proposal would have prevailed. The reduction of pre-image security to 128 bits would be a step backwards compared to sha256, but I think no one was seriously arguing for security levels >256 bit— even assuming QC 256 bits should be adequate against all generic attacks. But once tampering was seriously raised as a concern, doing something as close to the original proposal as possible was much more attractive than other options.