1
$\begingroup$

After reading "Can the xor of two RNG outputs ever be less secure than one of them?" I wondered if you can increase security of SHAKE256_XOF by using another instance of the CSRNG. The theoretical security of SHAKE256_XOF is 256 bits. After a theoretical quantum attack it has min(key_length/2, 256) bit security. So using a 512 bit key SHAKE256_XOF should theoretically be able to generate a bit stream of any length with 256 bits of security against classical and quantum attacks.

If you were to compute SHAKE256_XOF(key1) xor SHAKE256_XOF(key2) where both keys are independent true random numbers of at least 512 bits:

  1. Could you obtain a bit stream with more than 256 bits of security against classical attacks?
  2. Could you obtain a bit stream with more than 256 bits of security against quantum attacks?
  3. Can this lead to a bit stream that is weaker than 256 bits with the assumptions of the keys?
  4. What it the security of N SHAKE256_XOF generators chained with xor for classical and quantum attacks?
$\endgroup$
3
  • $\begingroup$ "After a theoretical quantum attack it has min(key_length/3, 256) bit security." - no, it has min(key_length/2, 256) bit security - collision attacks do not apply, hence the best attack is straight Grover's. $\endgroup$
    – poncho
    Mar 21, 2022 at 11:05
  • $\begingroup$ @poncho: Wouldn't a birthday attack create the same bit stream with a successful collision effectively breaking it? $\endgroup$
    – Brandon
    Mar 21, 2022 at 16:53
  • 1
    $\begingroup$ In a Birthday attack, we assume that the attacker can select both preimages (or, at least, influence them). In your scenario (we compute SHAKE based on a secret key), the attacker cannot specify the key. $\endgroup$
    – poncho
    Mar 21, 2022 at 17:07

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.