News for hackers. Stuff that matters.
Re:Too Much Crypto [pdf] by mlyle on Monday December 30, 2019 @10:29PM (#21918730)
> Exactly. The point is that a fair A/B speed comparison between competing ciphers should be normalizing both A and B to equivalent security margins

Assuming that A and B have received an equal amount of cryptanalytic attention and the "best publicly known" attacks represent equal amounts of effort/progress against the algorithm.

In practice, we need to overspecify algorithms initially, not knowing what the next 10-50 years of attacks will look like. Maybe 15 years in you go "woops, could have used fewer rounds-- we're holding up much better than I thought," but at that point the parameters are standard and...

Re:Too Much Crypto [pdf] by tptacek on Monday December 30, 2019 @10:59PM (#21918842)
Are you suggesting it's going to look a lot different from the previous 45 years? Because the previous 45 years suggest pretty strongly that we do in fact know how to design a block cipher.
Re:Too Much Crypto [pdf] by mlyle on Monday December 30, 2019 @11:12PM (#21918896)
Public knowledge of differential cryptanalysis is younger than 45 years, and was known to NSA 20+ years before its public "discovery" (and known to IBM 15 years before).

Multiple finalists in the AES competition (which selected Rijndael) had significant weaknesses found in the decade since, despite receiving relatively little attention (MARS, Serpent).

Re:Too Much Crypto [pdf] by tptacek on Monday December 30, 2019 @11:14PM (#21918902)
Which weaknesses are you referring to? Let's look at them the same way this paper looks at attacks on AES and Blake2.