Skip to main content
Title changed as Future Security suggested.
Link
kelalaka
  • 49.5k
  • 12
  • 118
  • 205

Why XOFs are bettermore convenient than Hash Functions in modeling Random Oracles

edited tags
Link
kelalaka
  • 49.5k
  • 12
  • 118
  • 205
polish
Source Link
kelalaka
  • 49.5k
  • 12
  • 118
  • 205

In this answer, it is mentioned that

Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd use some artificial construction around a fixed-size hash function to get the desired output size, but with XOFs you can just plug them right in without having to fear any mistakes on your side potentially breaking the proofs (most people don't know/understand in many cases, me included).

and NIST.FIPS.202 says

Extendable-output functions are different from hash functions, but it is possible to use them in similar ways, with the flexibility to be adapted directly to the requirements of individual applications, subject to additional security considerations.

When lookingActually, we can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.

atAt page 24 of the NIST document, however, with the section titletitled as Additional Consideration for Extendable-Output Functions Nist;

XOFs have the potential for generating related outputs—a property that designers of security applications/protocols/systems may not expect of hash functions.

We can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.

So;

  • Why XOFs are better than Hash FunctionFunctions in modeling Random oracles.?

In this answer, it is mentioned that

Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd use some artificial construction around a fixed-size hash function to get the desired output size, but with XOFs you can just plug them right in without having to fear any mistakes on your side potentially breaking the proofs (most people don't know/understand in many cases, me included).

and NIST.FIPS.202 says

Extendable-output functions are different from hash functions, but it is possible to use them in similar ways, with the flexibility to be adapted directly to the requirements of individual applications, subject to additional security considerations.

  • Is it just the fixed-size problem of hash functions? Like in RSA-PSS?

When looking at page 24 with section title Additional Consideration for Extendable-Output Functions Nist;

XOFs have the potential for generating related outputs—a property that designers of security applications/protocols/systems may not expect of hash functions.

We can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.

So;

  • Why XOFs are better than Hash Function in modeling Random oracles.

In this answer, it is mentioned that

Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd use some artificial construction around a fixed-size hash function to get the desired output size, but with XOFs you can just plug them right in without having to fear any mistakes on your side potentially breaking the proofs (most people don't know/understand in many cases, me included).

and NIST.FIPS.202 says

Extendable-output functions are different from hash functions, but it is possible to use them in similar ways, with the flexibility to be adapted directly to the requirements of individual applications, subject to additional security considerations.

Actually, we can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.

At page 24 of the NIST document, however, with the section titled as Additional Consideration for Extendable-Output Functions;

XOFs have the potential for generating related outputs—a property that designers of security applications/protocols/systems may not expect of hash functions.

So;

  • Why XOFs are better than Hash Functions in modeling Random oracles?
Source Link
kelalaka
  • 49.5k
  • 12
  • 118
  • 205
Loading