BLAKE2: “Harder, Better, Faster, Stronger” Than MD5

Re:BLAKE2: “Harder, Better, Faster, Stronger” Than MD5 by tptacek on Friday March 21, 2014 @09:44PM (#7446658)

MD5 has already been out-and-out replaced. For applications that require collision resistance, MD5 is already dangerous. Even in a setting where MD5 is unlikely to cause real problems, like in an HMAC authenticator, its use would still be flagged in an audit.

No competent new design in 2014 would use SHA1 either.

In the world we live in now, there are two "mainstream" options for hash functions: SHA2 (ie, SHA2/256, SHA2/512, &c) and SHA3. SHA3 is actually not at all mainstream (very few applications use it), but (a) that will change over time and (b) nobody will really bat an eyelid if you choose to use it.

What Zooko is advocating for is a third mainstream option: BLAKE2. BLAKE2 is derived from a well-regarded SHA3 finalist; the preponderance of evidence suggests that BLAKE2 is safe, and arguably a more conservative choice than SHA3 (a/k/a Keccak, pronounced "Ketchup"), because SHA3's novel sponge function design hasn't been banged on the way SHA2's design, which BLAKE sort of shares, has.

The reality is that for most software designers, this isn't an important issue; most software isn't constrained by the speed of its hashing algorithms (the common bottleneck in crypto code is the bignum work public key algorithms have to do --- if you're worried about bottlenecked on hashing, you probably have a much bigger problem with I/O).

[ Parent | on HN ]

Re:BLAKE2: “Harder, Better, Faster, Stronger” Than MD5 by dfc on Friday March 21, 2014 @11:56PM (#7447430)

I was wondering how the new "optional parallel mode" affects the long history of professional scrutiny. Is adding an optional parallel mode something that a professional cryptographer can do without significantly changing the security model?[^1] Are there certain families of hash designs amenable slight tweaks that sacrifice a little security for a relatively large speed improvement or is this something that could happen with the majority of hash schemes?

As always, thanks for playing "HN asks tptacek about security."

[^1]: This is a genuine question. I do not have any reason to doubt zooko et al's judgement. I guess another way of saying this is "For someone smarter than me is it easy to know when this is a good/bad idea?"

Strange segway: I was browsing Plos and saw this article about egg washing and shell characteristics. After reading the title for some reason I remembered reading a somewhat lengthy comment you wrote about the safety of eggs and different egg washing regimes in the us and the uk. I did not check too see if my recollection was accurate but in case it is and the comment was indicative of your interest in the subject you might get a kick out of:

Effect of Egg Washing and Correlation between Eggshell Characteristics and Egg Penetration by Various Salmonella Typhimurium Strains. PLoS ONE 9(3): e90987. doi:10.1371/journal.pone.0090987

http://www.plosone.org/article/info%3Adoi%2F10.1371%2Fjourna...

[ Parent | on HN ]

Re:BLAKE2: “Harder, Better, Faster, Stronger” Than MD5 by pbsd on Saturday March 22, 2014 @12:04AM (#7447468)

If you do the padding and signaling of last nodes correctly, which as far as we know BLAKE2 does, a break in the parallel mode translates to a break in the sequential hash function. This was proven by the Keccak people a while ago [1].

[1] http://eprint.iacr.org/2009/210

[ Parent | on HN ]