Hot answers tagged

98

First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, nobody will switch. Security is not a reason. Between SHA-2 and SHA3, there is no reason to believe that one is more secure than the other. It isn't like when ...


29

I'd say that the whole argument hinges around a "secret attack" that possibly the NSA may know of, enabling them to break some instances of elliptic curves that the rest of the World considers as safe, because the secret attack is, well, secret. This yields to the only possible answer to your question: since secret attacks are secret, they are not known to ...


26

Is this number specified anywhere? It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from that same document is actually more popular. Why was this particular number picked? Well, it's a safe prime; in addition, the leading 64 bits and the ...


26

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private company) naming convention. Before SHA (which was the original name; SHA-0 is retroactive terminology given to distinguish the original proposal from what was ...


22

I would characterize the service as similar to a trusted time-stamping service. Except they do not do the time-stamping, but just provide the "key". This allows a user to decide what do to with it, such as using it as a private key to sign something, or an HMAC key, proving the signature is "not older" than the timestamp. If the signature is published to a ...


22

With any $n$ bit hash it is possible to: Find preimages with work $2^n$ on classical computers and $2^{n/2}$ using quantum computers Find collisions with work $2^{n/2}$ on classical computers and $2^{n/3}$ using quantum computers I want to emphasize that these are generic attacks that always work, no matter which concrete hashfunction is used. Grover's ...


22

Please check https://tools.ietf.org/search/rfc4492 - espessially, the "Appendix A. Equivalent Curves (Informative)" part. For example: NIST P-256 is refered to as secp256r1 and prime256v1. Different names, but they are all the same.


20

Is there any functional difference on how this process is conducted? One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and that is what they did. In contrast, they are likely to approve at least two proposals (both for kem/public key encryption, and the signature side of things, so ...


19

512 bits (rounded down from the 664 bits or 200 digits in the patent) was recommended from its conception in 1974 and throughout the 1980s. Indeed, 463 bits was considered sufficient in the mid-1990s for the RSA-140 challenge. Whether key strengths as low as 100 digits (330 bits) were ever used in the early 1980s embedded systems is unclear; but probable ...


18

No they did not, the internals and security levels have not been changed from the draft Keccak submission, only the padding rule has changed. The padding change is the only difference, this allows future tree hashing modes as well as the current SHAKE outputs to generate different digests given the same security parameters and message inputs. Up to 4 ...


17

This is a though question that is surfing at the limits of meta/political wars within the cryptography community. SafeCurves is a good resource, but it's very opinionated about what "safe" means. As an example secp256k1, the curve used by Bitcoin and Ethereum to guarantee their security is deemed "unsafe" by the SafeCurves team, while it ...


16

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Indeed, the US is known from some crypto-related competitions that were/are open to anyone and they surely will do ample of government research related to cryptology, but you need to be sure that you differ between “they selected it” and “they ...


16

The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is $$x_1 \parallel x_2 \parallel \dots \parallel x_n$$ as a concatenation of the series described by $$\parallel_{i=1}^n x_i.$$ Furthermore, it's worth noting that + to a mathematician would suggest that it is a commutative, which might not ...


15

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For hash functions, neither SHA-2 nor SHA-3 are depending on AES in any way. The sponge function in Keccak (SHA-3) can also be used as a symmetric cipher (Ketje, ...


14

[source of information: my interpretation of multiple hallway chats I've had with DJB and Tanja Lange at conferences] The actual NIST PQC submission was for two reasons: A joke. Evidence1: DJB yelling from the back of the room "How much RAM does the NIST benchmarking machine have??" Dustin Moody replying "Dan, we're not benchmarking pqRSA!". Evidence2: DJB ...


14

Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion: I believe that there are several aspects contributing to it: Most application designers (that is, the people who use crypto to actually solve a problem) generally don't ...


13

The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg: $\log_2{0.886\sqrt{2^{571}}} = 285.32537860389294$ The real computation (at least for curves over a finite field defined by a prime $p$) is $ \log_2{\sqrt{\pi/4}\sqrt{ℓ}} $, where $ℓ$ is the ...


11

The pqRSA proposal technically complies with the NIST rules for the competition, and, as all governmental organizations, NIST tends to be stickler for rules. Now of course it's a sort of joke (whether it is a good one, or whether it was taken a bit too far, is a matter of taste). From a pure cryptographic point of view, it might be useful as an illustration ...


11

If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United States, you might be required to use United States government standards for cryptography. There are many national pride cryptography standards that have little ...


10

This has been basically asked already: Should we trust the NIST recommended ECC parameters? History Once it was found that NSA allegedly had inserted backdoor to a cryptographic standard, people started thinking what standard it was. The most common guess is that the Dual EC DRBG is the backdoored standard. However, some amount of (possibly justified) ...


10

The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? Is there some cryptographic attack which is unique to Rijndael which would warrant this? During the second AES conference, the Rijndael team was asked about this design decision. They turned it around, and pointed out that smaller keys ...


9

Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation. One reason is maybe that + might be confusing when talking about fundamental cryptography, since there is a lot of math involved. The mathematical notation for 'OR' would be reversed caret $\lor$ and the exclusive 'OR', better known as 'XOR' is a circled plus $\oplus$. ...


9

From Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process 3.12 NewHope NewHope is a KEM based on the presumed hardness of the RLWE problem. At its core is Regev’s original idea for public-key encryption from plain LWE but specialized to a power-of-2 cyclotomic ring structure, enabling smaller ciphertext and key ...


8

First up: Don't believe the hype! Especially if things can easily be proven wrong. What I mean is that your NIST have just launched a new service… is incorrect, as the NIST Randomness Beacon project is known to me (and others) since 2011. Furthermore, this project was awarded a multi-year grant from NIST's Innovations in Measurement Science (IMS) Program in ...


8

The routine you link to is already performing that check (lines 15-17): it returns $(0,0,0)$ when $S$ and $T$ are equal, and the caller is expected to handle this by calling the doubling routine. The equality verification is performed by checking whether $$X_1Z_2^2 - X_2Z_1^2 = 0$$ $$Y_1Z_2^3 - Y_2Z_1^3 = 0$$ It is easy to see that, since $x = X/Z^2$ ...


8

The second paragraph in the link you shared says the following: It is intended that the new public-key cryptography standards will specify one or more additional unclassified, publicly disclosed digital signature, public-key encryption, and key-establishment algorithms that are capable of protecting sensitive government information well into the ...


8

One of the failing test discussed in the question was coded for the purpose. It could be useful to validate that code using a known-good pseudo-random source (the output of SHA-256 for incremental values qualifies). If it failed too often, the code would need a fix! The test's definition is complex, for example in 2.7.4 (2) defining how to count the number ...


8

First: Entropy is a property of a random variable in a physical process or a state of knowledge with more than one possible outcome, not a property of a deterministic function or a fixed known value. If you treat a fixed known value as a random variable with a trivial probability distribution with only one possible outcome, then its entropy is precisely ...


8

This constant is used to approximate $(\pi(2^k) - \pi(2^{k-1}))^{-1}$, as shown in (4.1) of the Damgard et al. paper: $$ p_{k,t} \le (\pi(2^k) - \pi(2^{k-1}))^{-1} \sum\nolimits'_{n \in M_k} \bar{\alpha}(n)^t \,. $$ Most of the formula in the NIST document, between the square brackets, is dealing with the $\bar\alpha$ sum. The left side is dealing with the ...


7

It you need a deterministically derived key for AES, the DRBG algorithms of NIST SP 800-90A are suitable, and their output is directly usable as an AES key. An example use case is when computing an AES session key from a longer-term master key, and the nonce corresponding to that session. AES will expand its key (128, 192 or 256-bit) to 128-bit subkeys (one ...


Only top voted, non community-wiki answers of a minimum length are eligible