News for hackers. Stuff that matters.
Re:Maybe Skip SHA-3 by remcob on Wednesday May 31, 2017 @03:48PM (#14455348)
True, the symmetric primitives are sort of interchangeable, but I'd like to see how to build an AEAD using hash functions that doesn't require you process the data twice. I don't think it can be easily done, if at all. It certainly won't do to combine a HMAC with a CTR-mode encryption.

Keccak allows for very simple and efficient implementations of all these primitives.

> H(key ‖ m)

This is insecure for SHA2 (length extension). However, it is secure when done with SHA3. In fact, it's pretty much how you construct a MAC from it, that's how natural it is.

HMAC was invented specifically to deal with the shortcomings of SHA2 and predecessors. For reference, it is H(key ⊕ opad, H(key ⊕ ipad, m)), where opad = 0x5C… and ipad = 0x36…. Compare that with the above and you'll see what I mean with simple and efficient.

Re:Maybe Skip SHA-3 by tptacek on Wednesday May 31, 2017 @04:00PM (#14455446)
Why can't you just use a prefix MAC with SHA-2 512/224?
Re:Maybe Skip SHA-3 by remcob on Wednesday May 31, 2017 @04:15PM (#14455543)
You can, and you just invented the Sponge construction in the process! :)

The key idea is to only expose part of the state to inputs/outputs.

Re:Maybe Skip SHA-3 by tptacek on Wednesday May 31, 2017 @04:19PM (#14455577)
Sure, but SHA-2 512/224 predates SHA-3 and the Sponge construction by, what, a decade and a half?

And prefix MACs predate all these things by multiple decades (they just happen to be insecure in full-width-output MD hashes).

I don't think the ability to use Keccak as a simple prefix MAC is all that gamechanging. You can hash data once --- and much, much faster --- by using SHA-2.

Re:Maybe Skip SHA-3 by ctz on Thursday June 01, 2017 @05:51AM (#14459031)
This is an example of a wide-pipe hash function, not a sponge.