News for hackers. Stuff that matters.

A comment on Maybe Skip SHA-3. Parent comment

Re:Maybe Skip SHA-3 by tptacek on Wednesday May 31, 2017 @04:00PM (#14455446)
Why can't you just use a prefix MAC with SHA-2 512/224?
[ Parent | on HN ]
Re:Maybe Skip SHA-3 by remcob on Wednesday May 31, 2017 @04:15PM (#14455543)
You can, and you just invented the Sponge construction in the process! :)

The key idea is to only expose part of the state to inputs/outputs.

[ Parent | on HN ]
Re:Maybe Skip SHA-3 by tptacek on Wednesday May 31, 2017 @04:19PM (#14455577)
Sure, but SHA-2 512/224 predates SHA-3 and the Sponge construction by, what, a decade and a half?

And prefix MACs predate all these things by multiple decades (they just happen to be insecure in full-width-output MD hashes).

I don't think the ability to use Keccak as a simple prefix MAC is all that gamechanging. You can hash data once --- and much, much faster --- by using SHA-2.

[ Parent | on HN ]
Re:Maybe Skip SHA-3 by ctz on Thursday June 01, 2017 @05:51AM (#14459031)
This is an example of a wide-pipe hash function, not a sponge.
[ Parent | on HN ]