Why Keccak is not ARX

Re:Why Keccak is not ARX by amelius on Wednesday September 20, 2017 @05:35AM (#15291972)

> (...) (crypt)analyzing ARX, despite its merits, is relatively unrewarding in terms of scientific publications: It does not lend itself to a clean mathematical description and usually amounts to hard and ad-hoc programming work. A substantial part of the cryptographic community is therefore reluctant to spend their time trying to cryptanalyze ARX designs. We feel that the cryptanalysis of more structured designs such as Rijndael/AES or Keccak/SHA-3 leads to publications that provide more insight.

Ok, but this also holds for possible attackers.

[ Parent | on HN ]

Re:Why Keccak is not ARX by gcp on Wednesday September 20, 2017 @06:04AM (#15292103)

The nuance that's being made here is that the public cryptanalytic results we have are from researchers that need to publish. However blackhats (be it government or private) have no such need. Thus, they do not care if the analysis is elegant or neat.

This means that ARX functions will have less published analysis, but may still be successfully attacked.

This isn't even a new argument they're making here. It's been well understood that simple cipher designs are better, because they are easier to understand. If you can understand it well, yet not break it, that gives confidence. If you don't understand it, it might break as soon as you do.

[ Parent | on HN ]

Re:Why Keccak is not ARX by Confiks on Wednesday September 20, 2017 @08:34AM (#15292989)

While security by obscurity might be a valid security layer in some systems [1], it rarely is considered a good one when designing cryptosystems; Kerckhoff's principle [2] is usually adhered to thoroughly.

[1] https://danielmiessler.com/study/security-by-obscurity/

[2] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

[ Parent | on HN ]

Re:Why Keccak is not ARX by baby on Wednesday September 20, 2017 @10:29AM (#15294105)

There are two schools:

* make your cipher complicated, so that analysis and attacks are hard

* make your cipher easier to analyze and attack

The second one usually brings more confidence in the strength of the algorithm after a long period of peer review and cryptanalysis.

PS: not sure but I think I remember reading that Ketje was designed specifically to make theoretical attacks and analysis easier: https://keccak.team/ketje_contest.html

[ Parent | on HN ]