21–30 of 51 posts
can someone ELI5 why this is useful over existing hash functions?
This is how I feel when people start talking about cryptography. Definitely feel my university underprepared me on this topic. :(
Earlier quoted context omitted.
There are plenty of digits in pi. If the hash is secure independent of s-box selection, I'd much rather bet on pi being normal than "the NIST beacon values aren't generated by AES in CTR mode" ;-)
> There are plenty of digits in pi. Yes, but "These fears can be allayed by using numbers created in a way that leaves little room for adjustment. An example would be the use of initial digits from the number π as the constants. Using digits of π millions of places after the decimal point would not be considered trustworthy because the algorithm designer might have selected that starting point because it created a se…
Earlier quoted context omitted.
> There are plenty of digits in pi. Yes, but "These fears can be allayed by using numbers created in a way that leaves little room for adjustment. An example would be the use of initial digits from the number π as the constants. Using digits of π millions of places after the decimal point would not be considered trustworthy because the algorithm designer might have selected that starting point because it created a se…
So why not just use the first 8192 bytes of Pi?
Looks interesting! What is meant by a “universal family”?
Basically it makes it more difficult for an adversary to exploit collisions from your hash function.
Looks interesting! What is meant by a “universal family”?
> The default S-box > This was obtained from random.org by requesting 8,192 random bytes, as were all S-boxes tested so far. https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number
It should probably just default the s-box to all zeroes or some other method of deriving it ex-nihilo, but a default is practical just so you don't need to synchronize s-boxes between uses. I would imagine anyone interested in using this for serious business™ would start with a new s-box hierarchy.
That's not how S-boxes work, and crypto is best done with sane defaults.
Earlier quoted context omitted.
So why not just use the first 8192 bytes of Pi?
Because they are known in advance and you could design to exploit their structure.
Earlier quoted context omitted.
So why not just use the first 8192 bytes of Pi?
Because they are known in advance and you could design to exploit their structure.
That's the point.
The stated design - which I haven't reviewed in depth, but let's roll with it - is predicated on the use of a random s-box. Their goal is to have half zeros, half ones. That strikes me as strange, because my understanding is that confusion typically comes from balancing output bits for any given input bit.
But fine, we'll take it. I'm willing to bet the first 2^13 digits of pi are as balanced as any random number you use to bootstrap this thing.
FWIW, AIUI, totally random S-boxes typically give great non-linearity but perform poorly against differential cryptography. I'd bet that if anyone tested this one out that's where it would fail.
Earlier quoted context omitted.
This is how I feel when people start talking about cryptography. Definitely feel my university underprepared me on this topic. :(
That's the wrong attitude. Universities are a place where you should be much of the learning yourself. There is not enough time in a class for a lecturer to recite every word or idea that is present in a large textbook but there is definitely enough time outside of class to read it.
The professors in the first three years of my schooling definitely did everything wrong, then. Passing and failing classes had next to nothing to do with independent learning.