103 votes

Why isn’t SHA-3 in wider use?

First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, ...
Gilles 'SO- stop being evil''s user avatar
29 votes
Accepted

Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?

Please check https://tools.ietf.org/search/rfc4492 - espessially, the "Appendix A. Equivalent Curves (Informative)" part. For example: NIST P-256 is refered to ...
user42790's user avatar
  • 306
27 votes
Accepted

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

Is this number specified anywhere? It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from ...
poncho's user avatar
  • 147k
26 votes
Accepted

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
poncho's user avatar
  • 147k
23 votes
Accepted

Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?

The question does an apple-to-orange comparison: Google's level-1 Certificate #3318 is for a "software library" , IBM's level-4 certificate #3410 is for a "PCIe Cryptographic ...
fgrieu's user avatar
  • 141k
20 votes

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

Is there any functional difference on how this process is conducted? One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and ...
poncho's user avatar
  • 147k
19 votes
Accepted

Why is pqRSA in the NIST PQC submissions?

[source of information: my interpretation of multiple hallway chats I've had with DJB and Tanja Lange at conferences] The actual NIST PQC submission was for two reasons: A joke. Evidence1: DJB ...
Mike Ounsworth's user avatar
18 votes
Accepted

Why are NIST curves still used?

This is a though question that is surfing at the limits of meta/political wars within the cryptography community. SafeCurves is a good resource, but it's very opinionated about what "safe" ...
Lery's user avatar
  • 7,679
16 votes
Accepted

How did || come to be used in crypto texts to represent concatenation?

The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is $$x_1 \parallel x_2 \parallel \dots \parallel x_n$$ as a concatenation of the ...
b degnan's user avatar
  • 4,820
16 votes

Is there a contingency plan in the event of a catastrophic attack on AES?

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
Maarten Bodewes's user avatar
  • 92.6k
15 votes
Accepted

What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)

If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United ...
Squeamish Ossifrage's user avatar
14 votes

Why isn’t SHA-3 in wider use?

Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion: I believe that ...
poncho's user avatar
  • 147k
13 votes

Why is pqRSA in the NIST PQC submissions?

The pqRSA proposal technically complies with the NIST rules for the competition, and, as all governmental organizations, NIST tends to be stickler for rules. Now of course it's a sort of joke (...
Thomas Pornin's user avatar
11 votes

NewHope and NIST's Post-quantum standardization

From Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process 3.12 NewHope NewHope is a KEM based on the presumed hardness of the RLWE problem. At its core is ...
kelalaka's user avatar
  • 48.5k
10 votes
Accepted

Why was Rijndael the only cipher to have a variable number of rounds?

The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? Is there some cryptographic attack which is unique to Rijndael which would ...
poncho's user avatar
  • 147k
9 votes

How did || come to be used in crypto texts to represent concatenation?

Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation. One reason is maybe that + might be ...
AleksanderCH's user avatar
  • 6,445
8 votes
Accepted

NIST's Public-Key Post-Quantum cryptographic public calling

The second paragraph in the link you shared says the following: It is intended that the new public-key cryptography standards will specify one or more additional unclassified, publicly disclosed ...
Ella Rose's user avatar
  • 19.6k
8 votes

Are my random numbers really "bad" or is that a statistical effect which "must" happen from time to time?

One of the failing test discussed in the question was coded for the purpose. It could be useful to validate that code using a known-good pseudo-random source (the output of SHA-256 for incremental ...
fgrieu's user avatar
  • 141k
8 votes

How to interpret the entropy results for a NIST test file?

First: Entropy is a property of a random variable in a physical process or a state of knowledge with more than one possible outcome, not a property of a deterministic function or a fixed known value. ...
Squeamish Ossifrage's user avatar
8 votes
Accepted

Magic Number to calculate number of rounds for M-R in FIPS 186-4

This constant is used to approximate $(\pi(2^k) - \pi(2^{k-1}))^{-1}$, as shown in (4.1) of the Damgard et al. paper: $$ p_{k,t} \le (\pi(2^k) - \pi(2^{k-1}))^{-1} \sum\nolimits'_{n \in M_k} \bar{\...
Samuel Neves's user avatar
  • 12.5k
7 votes
Accepted

What's the reason for Monte Carlo tests for block ciphers?

As usual, government departments simply repeat their existing rules. So they incorporated the Monte Carlo tests from earlier test documents, this time from 1980. If you follow the dusty trail from ...
Paul Uszak's user avatar
  • 15.4k
7 votes

Why weak modes of operations are not banned?

All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an ...
Maarten Bodewes's user avatar
  • 92.6k
7 votes

Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?

Please don't. TestU01 or NIST? Neither. Trust what they say on the xoshiro256+ website. A CSPRNG is not defined by it's speed. It's defined by security against ...
Paul Uszak's user avatar
  • 15.4k
7 votes
Accepted

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this? No. There is one overwhelming reason why, as stated in the document: The cryptographic systems that NSA produces, ...
Richie Frame's user avatar
  • 13.1k
7 votes

Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?

Google (GCP) does provide level 3 with HSMs, see https://cloud.google.com/kms/docs/hsm. They apparently didn't get the validation in their own name.
Swashbuckler's user avatar
  • 2,053
7 votes

Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?

I wouldn't assume that a difference in chosen FIPS 140-2 levels tells you anything at all about the relative security of two systems. FIPS 140-2 validation is controversial in the cryptography ...
A B's user avatar
  • 171
6 votes

Conditioning Component in Entropy Source

The Ways Things Should Be is that when one tests data, one knows (independently of the data) from what this data came from, and therefore if the origin of the data is the output of a Conditioning ...
fgrieu's user avatar
  • 141k
6 votes

Naming convention for NIST elliptic curves in OPENSSL

The good thing about standards is that there are so many to choose from. The P-192, P-224, P-256, P-384 and P-521 names come from the FIPS DSS (Latest version of which is FIPS 186-4): https://...
Matt Caswell's user avatar
6 votes
Accepted

Diffie-Hellman Primitives in SP800-56A

A group is a set of elements and some operation that satisfy some requirements. This operation is usually called "addition" or "multiplication", depending on the group, even though ...
Conrado's user avatar
  • 6,434
6 votes

ECDSA signature with Brainpool curves in TLS possible?

RFC 8734 defines how to use Brainpool curves within TLS 1.3, including how they can be used in ECDSA signatures (section 4) . Hence, yes, there is an official way to negotiate Brainpool curves for ...
poncho's user avatar
  • 147k

Only top scored, non community-wiki answers of a minimum length are eligible