3 ms·
This research obviously demonstrates the importance of http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number http://en.wikipedia.org/wiki/Nothing_up_my_sleev
by mrb 12y ago
This research obviously demonstrates the importance of http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number This is why the SHA-1 round constants were chosen from a simple operation (square root) on a series of nondescript numbers:
√2 = 0x5A827999
√3 = 0x6ED9EBA1
√5 = 0x8F1BBCDC
√10 = 0xCA62C1D6
$ python -c 'for i in (2,3,5,10): print hex(int(i**.5*2**30))'
0x5a827999
0x6ed9eba1
0x8f1bbcdc
0xca62c1d6
However, it is a little bit strange that the designers chose √10 instead of √7 which would be the next logical number. Think about how many sets of constants can be generated in a nondescript way: for example they could have replaced √/2,3,5,10 with cos()/1,2,3,4, or sin()/2,4,8,16, etc. If there are, say, a million ways to generate sets of constants "above suspicion", but if 1 in a million exhibits a flaw, then in theory they could have carefully selected the one that introduces a flaw in SHA-1. (Personally I do not think it was malicious selected, but it is a fun thought experiment...)
- regd006 12y ago> Think about how many sets of constants can be generated in a nondescript way One example of this is the BADA55 curves[0]: > The name "BADA55" (pronounced "bad-ass") is explained by the appearance of the string BADA55 near the beginning of each BADA55 curve. This string is underlined in the Sage scripts above > We actually chose this string in advance and then manipulated the curve choices to produce this string. The BADA55-VR curves illustrate the fact that, as pointed out by Scott in 1999, "verifiably random" curves do not stop the attacker from generating a curve with a one-in-a-million weakness. The BADA55-VPR curves illustrate the fact that "verifiably pseudorandom" curves with "systematic" seeds generated from "nothing-up-my-sleeve numbers" also do not stop the attacker from generating a curve with a one-in-a-million weakness. [0] http://safecurves.cr.yp.to/bada55.html http://safecurves.cr.yp.to/bada55.html