4 ms·

Could I give a mention to Threefish as well? It's in the same vein as ChaCha20, but it's a block cipher, based on modern ideas, is more capable than AES, and n

Could I give a mention to Threefish as well? It's in the same vein as ChaCha20, but it's a block cipher, based on modern ideas, is more capable than AES, and naive implementations are resistant to power/timing attacks by default. Yet, I rarely hear much talk about it. Half of the time I see it discussed, it's along the lines of "Hey, AES is looking really old, should I use Threefish in my new application/library?" to which people respond "AES is proven and still secure, so just keep using that." Personally, I find Threefish to be a beautiful algorithm; simple and effective just like ChaCha20. Seems to me we've hit this local minima with various crypto algorithms. SHA2, AES, et. al are still considered secure, and almost no one has the guts to "risk" something new while the old stuff still works. Whereas before, we knew SHA1, DES, etc. were failing, so people were happy to jump to new algorithms as soon as they hit the market. (Side note: I chose to use Threefish-512 in my hardware password manager project. It gets used in the disk and database encryption, so its built in tweaking is a godsend.)

tptacek 12y ago
Can you actually pose an argument in favor of Threefish? I have suspicions as to why Threefish, Twofish, Blowfish, &c come up in discussions like these, but rarely in discussions between actual cryptographic engineers.
- tedunangst 12y ago
  A vigenere cipher with the Key "BRUCESCHNEIER" is in fact unbreakable.
  - tptacek 12y ago
    ... by the kinds of people who pick cryptographic primitives because they were authored by Bruce Schneier. (ducking)
- fpgaminer 12y ago
  I can tell you why I picked it, but I'm not a professional cryptographic engineer; just a hobbyist. Compared to AES: Implementation and use is dead simple and short (less room for bugs). The algorithm is easy to grasp. Naive implementations are resistant to timing and power analysis. Built in support for Tweaking, so you don't need to mess around with weird modes of operation. Large key size, and no mis-match between key and block size. Efficient (~6 cpb). It was designed by a large group of well known and respected cryptographers. The simplicity of Threefish is the most important, in my opinion. Applications of AES in the wild have been broken numerous times because of improper use of AES and its modes of operation. Threefish is less likely to suffer those issues, since Tweaking is built in. So, as of today, I think that benefit outweighs the possible risk of Threefish being found weak (and keep in mind that Threefish is specifically designed to resist analysis by using a large number of rounds. Breaks in reduced Threefish are expected, and are not likely to be breaks in full Threefish). Additionally, if people (e.g. Google) are willing to use ChaCha20, I don't see why they wouldn't be willing to use Threefish. They're built on the same principles, as far as I can tell, and both have just as much backing (in terms of peer review and who designed them). Again, the only arguments I've heard in favor of AES involve fear of the unknown.
  - tptacek 12y ago
    Sorry, I was unclear. I was comparing Threefish to ChaCha20. Yes, I can see reasons why someone would adopt Threefish over AES (AES predates mainstream tweakable cipher modes and, more importantly, was designed at a time when our understanding of microarchitecture side channels was crappy). What I can't see is why someone would militate for Threefish over Salsa20, or one of the eSTREAM portfolio ciphers, or at least say "wait and see" on CAESAR. What process happened that landed on Threefish for you? Incidentally: native support for tweakability is a good thing, but it doesn't mean you don't need support for "weird modes of operation". A tweakable cipher core is a primitive that you use with other tweakable block cipher modes. I'm a little confused by your claim that Threefish got as much review as Salsa20; Salsa20 is an eSTREAM winner, implying that a pretty big team of some of the best cryptographers in the world tried hard to break it as a cipher, and Threefish is just an artifact of a SHA-3 contestant that wasn't selected. Finally, 6 cpb isn't great, is it?
    - willvarfar 12y ago
      Turning your question on yourself, why do you think Threefish is not as good as Salsa20 or such? What about it makes you uneasy, and why?
      - tptacek 12y ago
        Salsa20 is better reviewed, it's faster, it's significantly simpler (Salsa20 is basically just a keyed hash core running in counter mode), it's a native stream cipher --- which is virtually always what you actually want --- and it's not idiosyncratic.
    - fpgaminer 12y ago
      > What process happened that landed on Threefish for you? I can't see why someone would advocate Threefish over ChaCha20 either. They serve different functions (one is a block cipher; the other a stream cipher). In my case, I needed a block cipher, hence my choice of Threefish. I brought up Threefish not in conflict with the top parent's suggestion of using ChaCha20, but rather to suggest its place alongside ChaCha20, Poly1305, Curve25519, etc. in a modern crypto toolbox. In other words, I was saying "If someone is building an application that requires a block cipher, they should take a strong look at Threefish over AES; contrary to popular wisdom." > A tweakable cipher core is a primitive that you use with other tweakable block cipher modes. Indeed, but, for example, disk encryption requires less and simpler code using Threefish versus AES in XTS mode. Not to mention the caveats to XTS mode. > I'm a little confused by your claim that Threefish got as much review as Salsa20 Off-hand, you're probably right that Salsa has more review than Threefish. But Threefish has more designers. And, Skein was one of the top SHA3 choices. Not that that conducts strength directly to Threefish, but it's a good sign. I mostly defer to Dmitry and Jon's comments here (http://crypto.stackexchange.com/questions/11725/has-threefish-successfully-been-attacked-practically-or-theoretically http://crypto.stackexchange.com/questions/11725/has-threefis...). > Finally, 6 cpb isn't great, is it? Quick searching shows Salsa20 as ~3cpb, AES as 20-30cpb, and AES-NI as 3.5cpb. So 6 is great in my book, with Salsa20's 3 being amazing.

tptacek 12y ago

Can you actually pose an argument in favor of Threefish? I have suspicions as to why Threefish, Twofish, Blowfish, &c come up in discussions like these, but rarely in discussions between actual cryptographic engineers.

tedunangst 12y ago
A vigenere cipher with the Key "BRUCESCHNEIER" is in fact unbreakable.
- tptacek 12y ago
  ... by the kinds of people who pick cryptographic primitives because they were authored by Bruce Schneier. (ducking)
fpgaminer 12y ago
I can tell you why I picked it, but I'm not a professional cryptographic engineer; just a hobbyist. Compared to AES: Implementation and use is dead simple and short (less room for bugs). The algorithm is easy to grasp. Naive implementations are resistant to timing and power analysis. Built in support for Tweaking, so you don't need to mess around with weird modes of operation. Large key size, and no mis-match between key and block size. Efficient (~6 cpb). It was designed by a large group of well known and respected cryptographers. The simplicity of Threefish is the most important, in my opinion. Applications of AES in the wild have been broken numerous times because of improper use of AES and its modes of operation. Threefish is less likely to suffer those issues, since Tweaking is built in. So, as of today, I think that benefit outweighs the possible risk of Threefish being found weak (and keep in mind that Threefish is specifically designed to resist analysis by using a large number of rounds. Breaks in reduced Threefish are expected, and are not likely to be breaks in full Threefish). Additionally, if people (e.g. Google) are willing to use ChaCha20, I don't see why they wouldn't be willing to use Threefish. They're built on the same principles, as far as I can tell, and both have just as much backing (in terms of peer review and who designed them). Again, the only arguments I've heard in favor of AES involve fear of the unknown.
- tptacek 12y ago
  Sorry, I was unclear. I was comparing Threefish to ChaCha20. Yes, I can see reasons why someone would adopt Threefish over AES (AES predates mainstream tweakable cipher modes and, more importantly, was designed at a time when our understanding of microarchitecture side channels was crappy). What I can't see is why someone would militate for Threefish over Salsa20, or one of the eSTREAM portfolio ciphers, or at least say "wait and see" on CAESAR. What process happened that landed on Threefish for you? Incidentally: native support for tweakability is a good thing, but it doesn't mean you don't need support for "weird modes of operation". A tweakable cipher core is a primitive that you use with other tweakable block cipher modes. I'm a little confused by your claim that Threefish got as much review as Salsa20; Salsa20 is an eSTREAM winner, implying that a pretty big team of some of the best cryptographers in the world tried hard to break it as a cipher, and Threefish is just an artifact of a SHA-3 contestant that wasn't selected. Finally, 6 cpb isn't great, is it?
  - willvarfar 12y ago
    Turning your question on yourself, why do you think Threefish is not as good as Salsa20 or such? What about it makes you uneasy, and why?
    - tptacek 12y ago
      Salsa20 is better reviewed, it's faster, it's significantly simpler (Salsa20 is basically just a keyed hash core running in counter mode), it's a native stream cipher --- which is virtually always what you actually want --- and it's not idiosyncratic.
  - fpgaminer 12y ago
    > What process happened that landed on Threefish for you? I can't see why someone would advocate Threefish over ChaCha20 either. They serve different functions (one is a block cipher; the other a stream cipher). In my case, I needed a block cipher, hence my choice of Threefish. I brought up Threefish not in conflict with the top parent's suggestion of using ChaCha20, but rather to suggest its place alongside ChaCha20, Poly1305, Curve25519, etc. in a modern crypto toolbox. In other words, I was saying "If someone is building an application that requires a block cipher, they should take a strong look at Threefish over AES; contrary to popular wisdom." > A tweakable cipher core is a primitive that you use with other tweakable block cipher modes. Indeed, but, for example, disk encryption requires less and simpler code using Threefish versus AES in XTS mode. Not to mention the caveats to XTS mode. > I'm a little confused by your claim that Threefish got as much review as Salsa20 Off-hand, you're probably right that Salsa has more review than Threefish. But Threefish has more designers. And, Skein was one of the top SHA3 choices. Not that that conducts strength directly to Threefish, but it's a good sign. I mostly defer to Dmitry and Jon's comments here (http://crypto.stackexchange.com/questions/11725/has-threefish-successfully-been-attacked-practically-or-theoretically http://crypto.stackexchange.com/questions/11725/has-threefis...). > Finally, 6 cpb isn't great, is it? Quick searching shows Salsa20 as ~3cpb, AES as 20-30cpb, and AES-NI as 3.5cpb. So 6 is great in my book, with Salsa20's 3 being amazing.