101
votes
Why isn’t SHA-3 in wider use?
First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, ...
28
votes
Accepted
Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?
Please check https://tools.ietf.org/search/rfc4492 - espessially, the "Appendix A. Equivalent Curves (Informative)" part.
For example: NIST P-256 is refered to ...
- 296
27
votes
Accepted
NIST Diffie-Hellman prime: how was it picked? Where did it come from?
Is this number specified anywhere?
It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from ...
- 145k
26
votes
Accepted
What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?
When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n
Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
- 145k
23
votes
Accepted
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
The question does an apple-to-orange comparison: Google's level-1 Certificate #3318 is for a "software library" , IBM's level-4 certificate #3410 is for a "PCIe Cryptographic ...
- 138k
20
votes
Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?
Is there any functional difference on how this process is conducted?
One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and ...
- 145k
17
votes
Accepted
Why is pqRSA in the NIST PQC submissions?
[source of information: my interpretation of multiple hallway chats I've had with DJB and Tanja Lange at conferences]
The actual NIST PQC submission was for two reasons:
A joke. Evidence1: DJB ...
- 3,577
17
votes
Accepted
Why are NIST curves still used?
This is a though question that is surfing at the limits of meta/political wars within the cryptography community.
SafeCurves is a good resource, but it's very opinionated about what "safe" ...
- 7,629
16
votes
Accepted
How did || come to be used in crypto texts to represent concatenation?
The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is
$$x_1 \parallel x_2 \parallel \dots \parallel x_n$$
as a concatenation of the ...
- 4,625
16
votes
Is there a contingency plan in the event of a catastrophic attack on AES?
I'm not aware of any official NIST policy on the matter, so I can only make educated guesses.
I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
- 91.7k
15
votes
Accepted
What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)
If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United ...
- 47.9k
14
votes
Accepted
How do I get the equivalent strength of an ECC key?
The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg:
$\log_2{0.886\sqrt{2^{571}}} = 285....
- 330
14
votes
Why isn’t SHA-3 in wider use?
Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion:
I believe that ...
- 145k
13
votes
Why is pqRSA in the NIST PQC submissions?
The pqRSA proposal technically complies with the NIST rules for the competition, and, as all governmental organizations, NIST tends to be stickler for rules.
Now of course it's a sort of joke (...
- 86.6k
11
votes
NewHope and NIST's Post-quantum standardization
From Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process
3.12 NewHope
NewHope is a KEM based on the presumed hardness of the RLWE problem. At its core is ...
- 47.6k
10
votes
Accepted
Why was Rijndael the only cipher to have a variable number of rounds?
The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this?
Is there some cryptographic attack which is unique to Rijndael which would ...
- 145k
9
votes
How did || come to be used in crypto texts to represent concatenation?
Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation.
One reason is maybe that + might be ...
- 6,406
8
votes
How do I get the equivalent strength of an ECC key?
The previous answer has the correct formula for estimating the security level of prime field elliptic curves. However, the table seems to just list the closest Koblitz curve sizes used, as Richie ...
- 32k
8
votes
Accepted
NIST's Public-Key Post-Quantum cryptographic public calling
The second paragraph in the link you shared says the following:
It is intended that the new public-key cryptography standards will specify one or more additional unclassified, publicly disclosed ...
- 19.5k
8
votes
Are my random numbers really "bad" or is that a statistical effect which "must" happen from time to time?
One of the failing test discussed in the question was coded for the purpose. It could be useful to validate that code using a known-good pseudo-random source (the output of SHA-256 for incremental ...
- 138k
8
votes
How to interpret the entropy results for a NIST test file?
First: Entropy is a property of a random variable in a physical process or a state of knowledge with more than one possible outcome, not a property of a deterministic function or a fixed known value. ...
- 47.9k
8
votes
Accepted
Magic Number to calculate number of rounds for M-R in FIPS 186-4
This constant is used to approximate $(\pi(2^k) - \pi(2^{k-1}))^{-1}$, as shown in (4.1) of the Damgard et al. paper:
$$
p_{k,t} \le (\pi(2^k) - \pi(2^{k-1}))^{-1} \sum\nolimits'_{n \in M_k} \bar{\...
- 12.4k
7
votes
Accepted
What's the reason for Monte Carlo tests for block ciphers?
As usual, government departments simply repeat their existing rules. So they incorporated the Monte Carlo tests from earlier test documents, this time from 1980. If you follow the dusty trail from ...
- 15.1k
7
votes
Why weak modes of operations are not banned?
All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an ...
- 91.7k
7
votes
Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?
Please don't.
TestU01 or NIST?
Neither. Trust what they say on the xoshiro256+ website. A CSPRNG is not defined by it's speed. It's defined by security against ...
- 15.1k
7
votes
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
Google (GCP) does provide level 3 with HSMs, see https://cloud.google.com/kms/docs/hsm. They apparently didn't get the validation in their own name.
- 2,023
7
votes
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
I wouldn't assume that a difference in chosen FIPS 140-2 levels tells you anything at all about the relative security of two systems.
FIPS 140-2 validation is controversial in the cryptography ...
- 171
6
votes
Accepted
More rounds after AES related key attack?
My question is how many more rounds would they have to use to keep this security margin on AES (other then adding a hash to AES 256 key schedule)?
When AES was standardized, the best known attack (...
- 32k
6
votes
Conditioning Component in Entropy Source
The Ways Things Should Be is that when one tests data, one knows (independently of the data) from what this data came from, and therefore if the origin of the data is the output of a Conditioning ...
- 138k
6
votes
Naming convention for NIST elliptic curves in OPENSSL
The good thing about standards is that there are so many to choose from.
The P-192, P-224, P-256, P-384 and P-521 names come from the FIPS DSS (Latest version of which is FIPS 186-4):
https://...
- 209
Only top scored, non community-wiki answers of a minimum length are eligible