Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Encryption Security Technology

SHA-3 Second Round Candidates Released 62

Posted by Soulskill from the narrowing-the-field dept.
Jeremy A. Hansen writes "NIST just announced their selections for algorithms going to the second round of the SHA-3 competition. Quoting: 'NIST received 64 SHA-3 candidate hash function submissions and accepted 51 first round candidates as meeting our minimum acceptance criteria. We have now selected 14 second round candidates to continue in the competition. Information about the second round candidate algorithms will be available here. We were pleased by the amount and quality of the cryptanalysis we received on the first round candidates, and more than a little amazed by the ingenuity of some of the attacks. ... In selecting this set of second round candidates we tried to include only algorithms that we thought had a chance of being selected as SHA-3. We were willing to extrapolate higher performance for conservative designs with apparently large safety factors, but comparatively unforgiving of aggressive designs that were broken, or nearly broken during the course of the review. We were more willing to accept disquieting properties of the hash function if the designer had apparently anticipated them, than if they were discovered during the review period, even if there were apparent fixes. We were generally alarmed by attacks on compression functions that seemed unanticipated by the submitters.'"
This discussion has been archived. No new comments can be posted.

SHA-3 Second Round Candidates Released More

SHA-3 Second Round Candidates Released

Comments Filter:

  • I was a little worried (Score:4, Interesting)

    by Omnifarious ( 11933 ) * <eric-slash.omnifarious@org> on Friday July 24, 2009 @09:09PM (#28815513) Homepage Journal

    I was a little worried by the plethora of submissions. I was worried it would take them forever to decide. But luckily they've been rather ruthless in culling for the third round. Given the data available on the The SHA-3 Zoo [tugraz.at] they chose wisely.

    Personally, I think Skein [skein-hash.info] is interestingly feature rich, which both worries and intrigues me. Looking it appears that all the features are built on a core in which the real security lies, so I'm not too worried. Skein's core in fact appears to be extremely simple.

    • Re:I was a little worried (Score:4, Funny)

      by OverlordQ ( 264228 ) on Friday July 24, 2009 @09:18PM (#28815551) Journal

      Well Bruce Schneier helped write it, this is the same man that once decrypted a box of AlphaBits [schneierfacts.com].

    • Re:I was a little worried (Score:5, Interesting)

      by mTor ( 18585 ) on Friday July 24, 2009 @09:30PM (#28815627)
      Skein is getting a lot of attention because Bruce Schneier is one of it's authors. It's a fine algorithm. Personally, after going through a bunch of them, I like BLAKE [131002.net] the best since its extremely simple and relies on old and proven functions that have withstood the test of time. Not to mention that it's extremely fast. I also like Blue Midnight Wish. I think the NIST will pick one of these three.

      • Re:I was a little worried (Score:4, Interesting)

        by Omnifarious ( 11933 ) * <eric-slash.omnifarious@org> on Friday July 24, 2009 @09:51PM (#28815721) Homepage Journal

        The thing I like about Skein is its tree mode. I've been working on a parallelizing version of sha256sum to see if I can speed up the generation of hashes 4-fold with my dual-core dual-processor system.

        I also like the ways you can make it unique for a given usage. This will help make it more resistant to various kinds of attacks when used in particular applications and mitigate the effect of certain kinds of algorithm weaknesses if they're discovered.

        But yeah, there are other candidates, and I'm more interested in the highest possible quality algorithm coming out of the process than I am in having my particular horse win.

        • Re:I was a little worried (Score:4, Informative)

          by Skuto ( 171945 ) on Saturday July 25, 2009 @02:16AM (#28816699) Homepage

          >The thing I like about Skein is its tree mode.

          Pretty much every hash in the competition can work in tree mode. Not all submitters defined a tree mode, but that shouldn't stop NIST from defining a good one.

          There are better performers than Skein, so unless those are all seriously weakened I doubt it can win. Skein looks good on high end hardware, and not so good on anything else (compared to some other top competitors).

        • How much is paralelizable, anyway? I'd really love it if I could offload stuff like that to the GPU. If only someone would get some actual good quality drivers out.
          *cough*ATiI'mLookingAtyou*cough*

      • Re:I was a little worried (Score:4, Interesting)

        by Martin Blank ( 154261 ) on Friday July 24, 2009 @10:04PM (#28815781) Homepage Journal

        I knew about Schneier being involved from early on, but I just noticed Bernstein made the last cut. Considering Bernstein's thoroughness (64-bit timestamps in his programs, and didn't he once talk about writing his own filesystem to address an external limitation that slowed down qmail?), I am very intrigued at how well CubeHash will do. He apparently admits that it suffers from some performance problems, but also says that he over-engineered it, and that it can be scaled back to improve speed while losing little in the way of security.

        Of the 14 candidates going into this round, his is one of only six that hasn't had to be revised so far. Of course, that he seems to have designed it completely on his own may work against him.

        • Re: (Score:3, Interesting)

          by letsief ( 1053922 )
          Depending on what you call a revision, Bernstein just revised CubeHash. A few days ago he posted a parameter tweak that significantly increases performance at the cost of some security. You can read about his tweak on his website at: http://cubehash.cr.yp.to/submission/tweak.pdf [cr.yp.to]

          • Re: (Score:2)

            by Skuto ( 171945 )

            It's unclear this tweak lowers security, probably the opposite. It has more rounds than the original submission.

            • Re: (Score:2, Informative)

              by letsief ( 1053922 )
              In a practical sense, yes, but the generic preimage attacks against the 512-bit variant of CubeHash work better as the "b" parameter increases. It's still well above the birthday bound, so maybe people shouldn't care. But, it does mean CubeHash16/32-512 "only" provides 384 bits of preimage resistance. That's probably beyond theoretical computation limits for the universe, so I think there's a pretty good argument we shouldn't care. At the same time, all the attacks, and preimage attacks in particular, w

        • Re: (Score:2)

          by mrmeval ( 662166 )

          djb admitted a flaw? But his stuff is perfect and precious according to him! He may be getting senile if he's admitting flaws.

          Has he ever developed anything as part of a team and not as either a dictator or a team of one?

  • SHA-3? (Score:1, Funny)

    by Anonymous Coward

    Pff. I'm already using SHA-256.

  • Congratulations.

  • We were generally alarmed by attacks on compression functions that seemed unanticipated by the submitters.

    Just when you think Entropy's a bitch...

  • Why didn't Whirlpool make the list of candidates? That sucker is fort knox.

    • Re: (Score:3, Informative)

      by compro01 ( 777531 )

      It appears that whirlpool was never submitted to the competition.

      • I think WHIRLPOOL is probably too slow for the SHA-3 competition. NIST said they are looking for something that is at least as fast as SHA-2, and WHIRLPOOL is quite a bit slower.

    • Re: (Score:3, Interesting)

      by Skuto ( 171945 )

      Because the Rijndael guys submitted something much better: Keccak.

    • There have been a few AES based candidates for SHA-3. Basically they improve on Whirlpool. So the ideas of Whirlpool were taken and enhanced for the competition.

      Using AES certainly has advantages. It may be possible to use current hardware acceleration and a lot is known of the algorithm. Newer hardware may combine the two. The disadvantages are also numerous.

      AES was never designed with hashing in mind and may have unknown vulnerabilities. Current hardware may not be resistant against some attacks that are

      • Whirlpool wasn't based on rijndael (AES). It was based on square, which rijndael was also based on.

  • Hey, cool! (Score:4, Interesting)

    by jd ( 1658 ) <imipak@[ ]oo.com ['yah' in gap]> on Friday July 24, 2009 @10:30PM (#28815881) Homepage Journal

    One of my favourites (Blue Midnight Wish) made it through, and one of the others with a really cool name (SandSTORM) wasn't broken in the 1st round.

    Yes, I know, that's NOT how to pick hash functions, but you've got to admit that cryptography isn't capturing the popular imagination at the present time, leaving data dangerously insecure. I believe that part of this is because most popular crypto-related functions (and cryptographic hashing is definitely one) have names that are a turnoff.

    Once upon a time, computing was for "the Egg Heads" and anyone daring to mention computers was automatically One Of Them. The Apple made computing sexy and it became fashionable.

    Cryptography has to do the same thing, if security is to be meaningful. Otherwise, it will remain for "Egg Heads Only" and we will continue to see horrific losses from naive and pathetic practices by people trying to avoid being tarred as geeky.

    • I suspect that, as with many other parts of computing, the people at large will use it once it becomes largely automatic, and not much before(crypto has the additional complication that it makes it even easier for n00bs to lose large amounts of data).

      As for crypto marketing, "military grade" seems to be the appellation of choice. Pity it means absolutely nothing...
      • Well, since crypto was considered a munitions for export from the USA, calling it military grade kind of fits.
        • Encryption was considered a munition for export-control purposes (technically, I think it still is), but that didn't extend to hash functions. It will be interesting to see what NSA does with the eventual SHA-3. NSA has cleared AES for Top Secret classified information. We'll see if they do the same thing with SHA-3. If so, then you really could call it military-grade. Though, really its tamper-resistant hardware chips that sets military-grade stuff apart from commercial stuff.

      • Re: (Score:3, Interesting)

        by jd ( 1658 )

        Military grade, according to ITAR, means the key is more than 56 bits (used to be 40 bits). Which, you're right, means nothing.

        Now, if I use the term "military-grade" for crypto, I would mean an algorithm that is certified NIST/NESSIE-approved for Secret or above (for mundane usage) or NIST/NESSIE-approved for Top Secret (for information that is commercially sensitive). That is still arguably market-babble, but at least it has a measure of respectability because NIST and NESSIE are reasonably trustworthy or

      • As for crypto marketing, "military grade" seems to be the appellation of choice. Pity it means absolutely nothing...

        Really?

        http://en.wikipedia.org/wiki/United_States_Military_Standard [wikipedia.org] That should help explain what MIL-SPEC actually means, and why it does have value.

    • It doesn't matter how cool the name is: once the winner is picked it will be SHA-3, in the same way that Rijndael became AES. In fact, the name Rijndael had slipped my memory and I had to Google it - and I'm interested in crypto.

      Besides, the general public might be able to name WEP and WPA as "types of encryption", but to hope for more than that, no matter how cool the name, is optimistic.

    • Re: (Score:1)

      by JSlope ( 1180805 )
      Cryptography must be simple, now it's too complicated to install and configure. And most end users don't see why they should bother. I think that there should be a separated encrypted mail network where everything is encrypted by default and you can't turn encryption off. This way you can set all your relatives on this system and be sure that nothing will be sent unencrypted.
      [shameless plug on]

      I'm trying to fix it. You can try ResoMail.com [resomail.com]

      [shameless plug off]

  • MD6 (Score:3, Interesting)

    by imbaczek ( 690596 ) <(imbaczek) (at) (poczta.fm)> on Saturday July 25, 2009 @03:02AM (#28816847) Journal
    I'm quite surprised Rivest didn't make it to round 2. Could anybody share some details about this decision?

    • Re: (Score:3, Informative)

      by Dj ( 224 )

      It was withdrawn from the contest [h-online.com]

      • Hmm, please do not read the last part of that article.

        If you do, I'll offer my opinion on it.

        Basically if MD6 is withdrawn it will not have too much value left for the immediate future. It will only live on in the minds of crypto-analysts for their next algorithms. It won't be adopted in any cryptographic products (both the all important libraries and hardware).

        Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods. Combining hash methods

        • Re: (Score:2, Insightful)

          by six ( 1673 )

          Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods. Combining hash methods is dangerous at least and should not be done haphazardly. It would be much better to use SHA-2 256 instead, if only because it is a standardized hash and not some weird combination of two.

          I think the author doesn't mean to combine SHA-1 and MD5 to make one hash, but instead using both hashes. This may be weaker for preimage attacks, but a lot stronger against c

        • Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods.

          So you're saying that nobody who uses SSL or TLS is in their right mind?

          (The SSL and TLS specifications require the use of both MD5 and SHA-1 during key derivation)

          • I *know*, it has given me endless nightmares getting it work with various hardware devices. That's exactly why it should not be used. Use SHA-2 instead.

            I've got more than 8 years of experience with security around HSM's and smart cards.

  • I've been doing a fair bit of reading about secure hashes recently... as I'm interested in one specific property of hash functions that, as far as I can tell, is not discussed as widely as I'd expect... While collisions seem to draw a lot of attention, they are not of particular interest to me... since collisions (for me) affect only performance - not security.

    The closest term for what I'm interested in is preimage resistance [wikipedia.org] - but, as far as I can tell, this property is often disregarded as it is considere

    • It is trivial to prove that a function is one way. If the input is from a larger domain than the output. ie a^b=c is one way. given c I cannot recover a and b. Of course this is not a good function to use for other reasons....

      If however the input is the same length then its a little harder...The only way we know how to do is the way this competition is doing it. Propose a "one way" function, others then try and break it. Otherwise you need a collision which in this context is a bad thing due to reduced r
  • 3 Second Rule Candidates Released?
  • The ultimate SHA should have a hash space as large as the count of atoms in the universe - then you can just select the atom involved and use its assigned number. Of course, collisions between atoms might be an issue.
    • SAH512 is roughly 1.2 X 10^154, atoms in visible universe is on the order of 10^80, job done :-)

Slashdot Top Deals

There are two ways to write error-free programs; only the third one works.

Close