63

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is particularly true in commodity parts, such as cell phones. When you make wireless ICs, you have two clocks in the system at a minimum, which are the carrier frequency ...


26

Is this number specified anywhere? It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from that same document is actually more popular. Why was this particular number picked? Well, it's a safe prime; in addition, the leading 64 bits and the ...


26

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private company) naming convention. Before SHA (which was the original name; SHA-0 is retroactive terminology given to distinguish the original proposal from what was ...


25

The real question isn't "Why doesn't Suite B use P-521?" It is, "Why doesn't Suite B use AES-192?" NSA were only interested in 192-bit security for Suite B, but they chose to use AES-256 because AES-192 wasn't widely supported. "In fact we had wanted to use AES -128 and AES-192, but a quick survey of AES implementations (hardware centric, I believe) ...


25

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): I found this on the TLS mailing list from Ilari Liusvaara: Ugh, the situation is way worse than what I thought. Basically, all three assume they have ...


22

I would characterize the service as similar to a trusted time-stamping service. Except they do not do the time-stamping, but just provide the "key". This allows a user to decide what do to with it, such as using it as a private key to sign something, or an HMAC key, proving the signature is "not older" than the timestamp. If the signature is published to a ...


22

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! A protocol is slightly different than a concrete implementation of a piece of software like the linux kernel on GitHub. It is closer to a specification that may be followed ...


20

Is there any functional difference on how this process is conducted? One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and that is what they did. In contrast, they are likely to approve at least two proposals (both for kem/public key encryption, and the signature side of things, so ...


17

The prefix sec stands for "Standards for Efficient Cryptography" (per the eponymous group, in the sense of assembly of experts). Brainpool stands for the name of another assembly of experts. After this, p (or P after Brainpool) stands for Prime, and is used for curves with an equation over field $\mathbb F_p$ of prime order. After sec, t is used ...


16

The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is $$x_1 \parallel x_2 \parallel \dots \parallel x_n$$ as a concatenation of the series described by $$\parallel_{i=1}^n x_i.$$ Furthermore, it's worth noting that + to a mathematician would suggest that it is a commutative, which might not ...


15

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For hash functions, neither SHA-2 nor SHA-3 are depending on AES in any way. The sponge function in Keccak (SHA-3) can also be used as a symmetric cipher (Ketje, ...


15

It is an open standard by IETF.org We can find the details in the mail archive of IETF, D. J. Bernstein's response; It has become increasingly common for "Curve25519" to refer to an elliptic curve, while the original paper defined "Curve25519" as an X-coordinate DH system using that curve. "Ed25519" unambiguously refers to an ...


13

Ericson's white paper lists them as The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity algorithms based on SNOW 3G, AES-CMAC, and ZUC. The main key derivation function is based on the secure HMAC-SHA-256. Notably, all of them are stream ciphers ...


12

I don't have any visibility into the BSI standardization process, and so this is a guess; I suspect one of two things happened: This is a potential way to deal with someone figuring out how to break both Brainpool and NIST curves (but not arbitrary elliptic curves; if they managed that, this hook won't help). In that case, if someone did that (or if we ...


11

Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview): The BSI's EC-Schnorr original specification was similar to ISO/IEC 14888-3's EC-SDSA-opt, standing for Elliptic Curve Schnorr Digital Signature Algorithm optimized version, except that EC-Schnorr ...


11

If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United States, you might be required to use United States government standards for cryptography. There are many national pride cryptography standards that have little ...


10

Please bear in mind that this information is all secondhand. I have not looked closely at the original drafts of Hash DRBG (although you might find a draft that's early enough if you peruse the FOIA results in [1]). However, during conversations with folks at NIST I was told that there were certain weaknesses in early drafts of Hash DRBG that were very ...


9

In May 2015, header files were uploaded to the OASIS PKCS 11 TC document repository by Dina Kurktchi-Nimeh that were versioned v2.40. However, they were uploaded to the "Working Drafts" folder. The meeting minutes from 2015-04-15 state that v2.40 is complete, but there is an action item for Dina to publish header files for v2.40 with errata (what would ...


9

Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation. One reason is maybe that + might be confusing when talking about fundamental cryptography, since there is a lot of math involved. The mathematical notation for 'OR' would be reversed caret $\lor$ and the exclusive 'OR', better known as 'XOR' is a circled plus $\oplus$. ...


8

The PKCS#11 standard has transitioned from RSA to the OASIS group: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=pkcs11 I am not sure why RSA/EMC's site doesn't mention this. I believe that v2.30 was close to finalization, but was never formally released. I am not sure what happened but v2.40 is now the current release candidate. v2.20 is ...


8

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it receive? Almost none. Bad idea.


8

First up: Don't believe the hype! Especially if things can easily be proven wrong. What I mean is that your NIST have just launched a new service… is incorrect, as the NIST Randomness Beacon project is known to me (and others) since 2011. Furthermore, this project was awarded a multi-year grant from NIST's Innovations in Measurement Science (IMS) Program in ...


8

The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (which they named as BNN signature) can achieve semi-strong unforgeability (ss-euf); while the signature in the form of $(h,s)$ can only achieve normal ...


8

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes. Pages 14-15 have the hash function specific information: SHA-1 for digital signature generation:      SHA-1 may only be used for digital signature generation ...


8

Political reasons likely wins. E.g. France has an own set of domain parameters. Note that when the spec was created that the Brainpool curves where rather new. Generating safe parameters is not trivial, but we're talking countries here. Most of them will simply copy what's out there or buy a solution, but a few of the more advanced ones can try other curves ...


8

Are there cryptosystems that have not been widely adopted in the West, that have been standardized by other major countries? Camellia is a block cipher similar in performance and security to AES. It was standardized by Japan's CRYPTREC and although various Western countries have standardized implementations of it, it is quite uncommonly used in the West. In ...


7

Under the assumption that $(K,\text{Msg})\to H_K(\text{Msg})$ is a secure MAC (be it HMAC or any other MAC), and $\text{Nonce}$ does not repeat and is of fixed size, both $H_K(\text{Msg}||\text{Nonce})$ and $H_K(\text{Nonce}||\text{Msg})$ are demonstrably secure, in the sense that an adversary not knowing $K$ can't distinguish either from random, even for ...


7

With SHA-3 Derived Functions (SP 800-185, pdf) there is now a standardized parallel hash based on SHA-3, called ParallelHash, appropriately. However, it is not a tree hash, but more of a hash-list-based mode. The string to be hashed is divided into equal-sized blocks, which are hashed, concatenated and then hashed again. While it is not a tree hash it ...


7

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the responses follow: First off, the authors are working on a design rationale in english for their new cipher. As soon as it's published, it will be linked here. ...


7

rfc5246 7.4.9 defines verify_data as PRF(master_secret, finished_label, Hash(handshake_messages)) [0..verify_data_length-1]; Note the second line; this effectively truncates the PRF output to verify_data_length octets. It goes on to say that verify_data size depends on the cipher suite. Any cipher suite which does not explicitly specify ...


Only top voted, non community-wiki answers of a minimum length are eligible