News for hackers. Stuff that matters.

A comment on Debunking NIST's calculation of the Kyber-512 security level. Parent comment

Re:Debunking NIST's calculation of the Kyber-512 security level by tptacek on Tuesday October 03, 2023 @06:27PM (#37758487)
It's very unlikely the seeds were random, and they weren't even ostensibly generated from a PRNG, as I understand it. Rather, they were passed through SHA1 (remember: this is the 1990s), as a means to destroy any possible structure in the original seed. The actual seeds themselves aren't my story to tell, but are a story that other people are talking about. For my part, I'll just point again to Koblitz and Menenzes on the actual cryptographic problems with the NIST P-curve seed conspiracy:

https://eprint.iacr.org/2015/1018.pdf

[ Parent | on HN ]
Re:Debunking NIST's calculation of the Kyber-512 security level by f33d5173 on Tuesday October 03, 2023 @06:31PM (#37758512)
A hash function is a (CS)PRNG. It has the key property, namely of being indistinguishable from randomness while being generated deterministically.
[ Parent | on HN ]
Re:Debunking NIST's calculation of the Kyber-512 security level by tptacek on Tuesday October 03, 2023 @06:48PM (#37758643)
In fact, `echo "This is my seed" | openssl sha -sha256` is not really a CSPRNG. Hash functions are the bases of many PRNGs. But I think you're abusing an ambiguity with the word "random" here. At any rate: we should be clear now on the point being made about the P-curve seeds.
[ Parent | on HN ]
Re:Debunking NIST's calculation of the Kyber-512 security level by Ar-Curunir on Tuesday October 03, 2023 @08:25PM (#37759408)
That is not true. There is no such requirement for a hash function.
[ Parent | on HN ]
Re:Debunking NIST's calculation of the Kyber-512 security level by ethbr1 on Tuesday October 03, 2023 @09:16PM (#37759744)
Thread is talking about cryptographic hash functions, given the context
[ Parent | on HN ]
Re:Debunking NIST's calculation of the Kyber-512 security level by Ar-Curunir on Wednesday October 04, 2023 @01:15AM (#37761080)
Yes, they don’t output random looking things necessarily. For example a hash function could be collision resistant but not pre image resistant, or vice versa. There’s much more nuance in these definitions.
[ Parent | on HN ]
Re:Debunking NIST's calculation of the Kyber-512 security level by wolf550e on Wednesday October 04, 2023 @04:59PM (#37771697)
This seems to be all that is publicly known about the seeds: https://saweis.net/posts/nist-curve-seed-origins.html
[ Parent | on HN ]