3 ms·
I recently (naively) dug into it to try and understand where it's magic comes from. I was under the impression that it also gets strength by flipping back and
by a-dub 12y ago
I recently (naively) dug into it to try and understand where it's magic comes from. I was under the impression that it also gets strength by flipping back and forth between F2 and Z+. Where AND and XOR are linear in F2, they're nonsense in Z+, where addition in Z+ is nonsense in F2 (not to forget the whole mod 2^32 part).
Is that actually true or did I just bs myself?
- pbsd 12y agoYou are correct: overlapping those two incompatible algebras is the main source of nonlinearity in SHA-256.
- optimiz3 12y agoYes, we don't have good ways to unify the flipping between GF32 and GF2 beyond down-converting to GF2 (which yields a massive increase in clause-complexity). GF32 addition in GF2 basically looks like a giant ripple-carry-adder.
- zvrba 12y ago> GF32 addition in GF2 basically looks like a giant ripple-carry-adder. I tried to implement addition in GF32 through Kogge-Stone adder because the dependency chain has length 5 instead of 32. No success. The intermediate variables got so complex that the BDD library I used at the time couldn't even synthesize the expression for a 32-bit adder.