SHA-3 Second Round Candidates Released 62
Jeremy A. Hansen writes "NIST just announced their selections for algorithms going to the second round of the SHA-3 competition. Quoting: 'NIST received 64 SHA-3 candidate hash function submissions and accepted 51 first round candidates as meeting our minimum acceptance criteria. We have now selected 14 second round candidates to continue in the competition. Information about the second round candidate algorithms will be available here. We were pleased by the amount and quality of the cryptanalysis we received on the first round candidates, and more than a little amazed by the ingenuity of some of the attacks. ... In selecting this set of second round candidates we tried to include only algorithms that we thought had a chance of being selected as SHA-3. We were willing to extrapolate higher performance for conservative designs with apparently large safety factors, but comparatively unforgiving of aggressive designs that were broken, or nearly broken during the course of the review. We were more willing to accept disquieting properties of the hash function if the designer had apparently anticipated them, than if they were discovered during the review period, even if there were apparent fixes. We were generally alarmed by attacks on compression functions that seemed unanticipated by the submitters.'"
Re: (Score:2)
Don't attack the encryption: attack how it's used!
Re: (Score:1)
This has all happened before:
http://slashdot.org/articles/04/08/17/0030243.shtml#9987007 [slashdot.org]
You got the caps wrong though.
Re: (Score:2)
e30830f3776f02798a92a2a7a2a6bce455b28e18
It would be less funny and harder to decode if I did this version.
Re: (Score:2)
MD5 isn't a hash function now?
I was a little worried (Score:4, Interesting)
I was a little worried by the plethora of submissions. I was worried it would take them forever to decide. But luckily they've been rather ruthless in culling for the third round. Given the data available on the The SHA-3 Zoo [tugraz.at] they chose wisely.
Personally, I think Skein [skein-hash.info] is interestingly feature rich, which both worries and intrigues me. Looking it appears that all the features are built on a core in which the real security lies, so I'm not too worried. Skein's core in fact appears to be extremely simple.
Re:I was a little worried (Score:4, Funny)
Well Bruce Schneier helped write it, this is the same man that once decrypted a box of AlphaBits [schneierfacts.com].
Re:I was a little worried (Score:5, Interesting)
I consider Bruce Scheier as a cryptographer to be sort of like Carl Sagan as an astronomer. I think he is a competent cryptographer, but I think he has much greater value as a person who can speak cogently about the issues surrounding cryptography.
In this case, my guess is that he led the overall vision of how Skein should work but that the other people who worked on the algorithm filled in the details. In particular, I strongly suspect that Niels Ferguson is principally responsible for the core algorithm. Of course, pulling apart any particular collaboration and looking for the efforts of individuals can be tricky and error prone at best.
Re: (Score:1)
He's got a friend with a horny dolphin, and imagines a threesome?
Scroll down for the sexy story.
http://www.williampoundstone.net/Sagan.html [williampoundstone.net]
Re:I was a little worried (Score:5, Funny)
That's actually bad news: Anybody can invent a cryptosystem he cannot break himself. Except Bruce Schneier. [schneierfacts.com]
Re:I was a little worried (Score:5, Interesting)
Re:I was a little worried (Score:4, Interesting)
The thing I like about Skein is its tree mode. I've been working on a parallelizing version of sha256sum to see if I can speed up the generation of hashes 4-fold with my dual-core dual-processor system.
I also like the ways you can make it unique for a given usage. This will help make it more resistant to various kinds of attacks when used in particular applications and mitigate the effect of certain kinds of algorithm weaknesses if they're discovered.
But yeah, there are other candidates, and I'm more interested in the highest possible quality algorithm coming out of the process than I am in having my particular horse win.
Re:I was a little worried (Score:4, Informative)
>The thing I like about Skein is its tree mode.
Pretty much every hash in the competition can work in tree mode. Not all submitters defined a tree mode, but that shouldn't stop NIST from defining a good one.
There are better performers than Skein, so unless those are all seriously weakened I doubt it can win. Skein looks good on high end hardware, and not so good on anything else (compared to some other top competitors).
Re: (Score:1)
*cough*ATiI'mLookingAtyou*cough*
Re:I was a little worried (Score:4, Interesting)
I knew about Schneier being involved from early on, but I just noticed Bernstein made the last cut. Considering Bernstein's thoroughness (64-bit timestamps in his programs, and didn't he once talk about writing his own filesystem to address an external limitation that slowed down qmail?), I am very intrigued at how well CubeHash will do. He apparently admits that it suffers from some performance problems, but also says that he over-engineered it, and that it can be scaled back to improve speed while losing little in the way of security.
Of the 14 candidates going into this round, his is one of only six that hasn't had to be revised so far. Of course, that he seems to have designed it completely on his own may work against him.
Re: (Score:3, Interesting)
Re: (Score:2)
It's unclear this tweak lowers security, probably the opposite. It has more rounds than the original submission.
Re: (Score:2, Informative)
Re: (Score:2)
djb admitted a flaw? But his stuff is perfect and precious according to him! He may be getting senile if he's admitting flaws.
Has he ever developed anything as part of a team and not as either a dictator or a team of one?
SHA-3? (Score:1, Funny)
Pff. I'm already using SHA-256.
Re: (Score:1)
There may only be three bits in a SHA-3 key, but those bits are extremely hard to guess.
Way to go, Bruce (Score:2)
Congratulations.
Let that be a lesson to you. (Score:2)
We were generally alarmed by attacks on compression functions that seemed unanticipated by the submitters.
Just when you think Entropy's a bitch...
Where's Whirlpool? (Score:1)
Re: (Score:3, Informative)
It appears that whirlpool was never submitted to the competition.
Re: (Score:1)
Re: (Score:3, Interesting)
Because the Rijndael guys submitted something much better: Keccak.
Re: (Score:2)
There have been a few AES based candidates for SHA-3. Basically they improve on Whirlpool. So the ideas of Whirlpool were taken and enhanced for the competition.
Using AES certainly has advantages. It may be possible to use current hardware acceleration and a lot is known of the algorithm. Newer hardware may combine the two. The disadvantages are also numerous.
AES was never designed with hashing in mind and may have unknown vulnerabilities. Current hardware may not be resistant against some attacks that are
Re: (Score:2)
Whirlpool wasn't based on rijndael (AES). It was based on square, which rijndael was also based on.
Hey, cool! (Score:4, Interesting)
One of my favourites (Blue Midnight Wish) made it through, and one of the others with a really cool name (SandSTORM) wasn't broken in the 1st round.
Yes, I know, that's NOT how to pick hash functions, but you've got to admit that cryptography isn't capturing the popular imagination at the present time, leaving data dangerously insecure. I believe that part of this is because most popular crypto-related functions (and cryptographic hashing is definitely one) have names that are a turnoff.
Once upon a time, computing was for "the Egg Heads" and anyone daring to mention computers was automatically One Of Them. The Apple made computing sexy and it became fashionable.
Cryptography has to do the same thing, if security is to be meaningful. Otherwise, it will remain for "Egg Heads Only" and we will continue to see horrific losses from naive and pathetic practices by people trying to avoid being tarred as geeky.
Re: (Score:2)
As for crypto marketing, "military grade" seems to be the appellation of choice. Pity it means absolutely nothing...
Re: (Score:1)
Re: (Score:1)
Re: (Score:3, Interesting)
Military grade, according to ITAR, means the key is more than 56 bits (used to be 40 bits). Which, you're right, means nothing.
Now, if I use the term "military-grade" for crypto, I would mean an algorithm that is certified NIST/NESSIE-approved for Secret or above (for mundane usage) or NIST/NESSIE-approved for Top Secret (for information that is commercially sensitive). That is still arguably market-babble, but at least it has a measure of respectability because NIST and NESSIE are reasonably trustworthy or
Re: (Score:1)
As for crypto marketing, "military grade" seems to be the appellation of choice. Pity it means absolutely nothing...
Really?
http://en.wikipedia.org/wiki/United_States_Military_Standard [wikipedia.org] That should help explain what MIL-SPEC actually means, and why it does have value.
Doesn't matter (Score:2)
It doesn't matter how cool the name is: once the winner is picked it will be SHA-3, in the same way that Rijndael became AES. In fact, the name Rijndael had slipped my memory and I had to Google it - and I'm interested in crypto.
Besides, the general public might be able to name WEP and WPA as "types of encryption", but to hope for more than that, no matter how cool the name, is optimistic.
Re: (Score:1)
[shameless plug on]
I'm trying to fix it. You can try ResoMail.com [resomail.com]
[shameless plug off]
Re: (Score:2)
It had too strong attacks against it.
MD6 (Score:3, Interesting)
Re: (Score:3, Informative)
It was withdrawn from the contest [h-online.com]
Re: (Score:2)
Hmm, please do not read the last part of that article.
If you do, I'll offer my opinion on it.
Basically if MD6 is withdrawn it will not have too much value left for the immediate future. It will only live on in the minds of crypto-analysts for their next algorithms. It won't be adopted in any cryptographic products (both the all important libraries and hardware).
Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods. Combining hash methods
Re: (Score:2, Insightful)
Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods. Combining hash methods is dangerous at least and should not be done haphazardly. It would be much better to use SHA-2 256 instead, if only because it is a standardized hash and not some weird combination of two.
I think the author doesn't mean to combine SHA-1 and MD5 to make one hash, but instead using both hashes. This may be weaker for preimage attacks, but a lot stronger against c
Re: (Score:2)
If he gets it standardized and included in standard implementations of cryptographic software and hardware - he would definitely have something there. But I would take opt for SHA-2 instead. It's well defined and present in more devices that having MD5 and SHA-1 work together. Of course that does not mean it cannot be included in proprietary or closed protocols, but for those anything goes. I agree that I may have put that a bit too strong though. But pretty please (with sugar on top) don't opt for these ki
Re: (Score:2)
So you're saying that nobody who uses SSL or TLS is in their right mind?
(The SSL and TLS specifications require the use of both MD5 and SHA-1 during key derivation)
Re: (Score:2)
I *know*, it has given me endless nightmares getting it work with various hardware devices. That's exactly why it should not be used. Use SHA-2 instead.
I've got more than 8 years of experience with security around HSM's and smart cards.
But can we "prove" that any of these are "one way" (Score:2)
I've been doing a fair bit of reading about secure hashes recently... as I'm interested in one specific property of hash functions that, as far as I can tell, is not discussed as widely as I'd expect... While collisions seem to draw a lot of attention, they are not of particular interest to me... since collisions (for me) affect only performance - not security.
The closest term for what I'm interested in is preimage resistance [wikipedia.org] - but, as far as I can tell, this property is often disregarded as it is considere
Re:But can we "prove" that any of these are "one w (Score:3, Interesting)
If however the input is the same length then its a little harder...The only way we know how to do is the way this competition is doing it. Propose a "one way" function, others then try and break it. Otherwise you need a collision which in this context is a bad thing due to reduced r
Re: (Score:2)
Everything you say makes sense, and I'm familiar with this technical background.
If I were to re-phrase my question, in the context of your reply, I'd be asking if equivalences have been shown between known-hard problems and the inverse to standard HMACs.
The particular issue that interests me is extremely similar to (type-1) preimage... but it is slightly easier to break. T1-preimage requires me to find m where H(m) is known. In my specific situation, we also know the length of m - it's the same as H(m) -
Did anybody else read that as... (Score:2)
SHA-Ultimate (Score:2)
Re: (Score:1)