Skip to main content
1 vote
Accepted

Security impact of weakened collision resistance for 128-bit Fiat-Shamir challenges

For Fiat-Shamir, we do not need collision resistance of the hash function, and $\lambda$ bits of output typically suffice. It is not too hard to see that collision-resistance is not a must-have: ...
Geoffroy Couteau's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible