Maybe Skip SHA-3

Re:Maybe Skip SHA-3 by tptacek on Wednesday May 31, 2017 @03:16PM (#14455142)

Observe also that Chapoly, which is built on a stream cipher generated from a hash running in counter mode, written by basically one of the pioneers of ciphers-from-hash-constructions, does not use its hash core as its MAC; it's simply faster to use a polynomial MAC.

[ Parent | on HN ]

Re:Maybe Skip SHA-3 by remcob on Wednesday May 31, 2017 @06:19PM (#14456380)

With a sponge construction the AEAD is a one-pass operation. You feed plaintext in, out comes ciphertext. In the end you crank it one more time and out comes the MAC/tag.

This is unlike other constructions, where you need to go over the data twice, with two different crypto algorithms (encryption + mac) that may or may not share a core component.

[ Parent | on HN ]

Re:Maybe Skip SHA-3 by tptacek on Wednesday May 31, 2017 @06:36PM (#14456477)

OCB does the same thing, without a sponge construction.

[ Parent | on HN ]

Re:Maybe Skip SHA-3 by baby on Wednesday May 31, 2017 @07:29PM (#14456733)

This is interesting, I've always seen it as bad because you had to decrypt first, and then you could verify the tag. But now I understand that this also allows you to have a one-pass operation.

[ Parent | on HN ]