Return to Question

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocols happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. SipHash-2-4-128).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocols happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocals happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocols happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocals happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is, How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory.

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocals happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).