Timeline for Does SHA384 make sense with HMAC-SHA256?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 7, 2021 at 17:48 | vote | accept | Curious | ||
| Aug 3, 2021 at 10:00 | comment | added | Maarten Bodewes♦ | As for the point about SHA-384: well, yes, for collision resistance it could be used, but it offers more security than 128 bit, which generally is considered impossible to break. Still, that's less security than HMAC-SHA-256 offers, so you could go for SHA-512 to offer ~256 bit security. | |
| Aug 3, 2021 at 9:57 | history | edited | Maarten Bodewes♦ | CC BY-SA 4.0 |
added 58 characters in body
|
| Aug 3, 2021 at 9:55 | comment | added | Maarten Bodewes♦ | Consensus? Um, yes, kind of. We simply assume the worst possible known attack against the primitives. Unless we have a hint that a stronger attack would be easily possible, then the order of the attack determines the security level. If the security level is just one or two bits off we generally just use the original strength (e.g. attacks on AES near $2^{127}$ do not significantly alter the 128 bit security). I've linked to keylength.com /NIST to give an idea of the security strength. | |
| Aug 3, 2021 at 9:50 | history | edited | Maarten Bodewes♦ | CC BY-SA 4.0 |
added 381 characters in body
|
| Aug 3, 2021 at 6:21 | comment | added | Curious | Your answer is not very clear to me. Can you explain a little bit? Specifically, I interpret your last paragraph as that it doesn't make much sense to use SHA384 instead of SHA256 here. But your second last paragraph kind of contradicts that saying that it could be used. Regarding the first paragraph, what, in your view, is the security level of HMAC-SHA256 then? Related to that, is there any consensus on the security levels of crypto primitives? If yes, is there an authentic and up to date source where one can find the up to date information on that? | |
| Aug 2, 2021 at 19:22 | history | answered | Maarten Bodewes♦ | CC BY-SA 4.0 |