News for hackers. Stuff that matters.

A comment on Maybe Skip SHA-3. Parent comment

Re:Maybe Skip SHA-3 by giovannibajo1 on Wednesday May 31, 2017 @07:00PM (#14456606)
Being resistant to common misuses is indeed a feature in real world cryptography. We saw that with DSA where you leak the private key if you happen to reuse a nonce; yes, you shouldn't do that, but it's better to choose an algorithm that doesn't suffer from this in the first place.

I'm not rooting for SHA-3; I'm just saying that it's wrong to dismiss length extension attacks only because they're commonly effective agains misuses of hash functions.

[ Parent | on HN ]
Re:Maybe Skip SHA-3 by stouset on Thursday June 01, 2017 @01:13AM (#14458149)
As tptacek points out elsewhere, if this is a concern for you, just use SHA-512/256. It's just as misuse-resistant, practically guaranteed to be in any library that would bother to implement SHA-3, faster by a mile, and has been the target of significantly more cryptanalysis.

There are zero practical reasons to choose SHA-3.

[ Parent | on HN ]