Re: RFC v3: Another proposed hash function transition plan

From: Gilles Van Assche <gilles.vanassche@st.com>
Date: Sep 18, 2017, 12:17 UTC
Message-ID: <59BFB95D.1030903@st.com>
In-Reply-To: <alpine.DEB.2.21.1.1709142037490.4132@virtualbox>

Hi Johannes,

> SHA-256 got much more cryptanalysis than SHA3-256 […].

I do not think this is true. Keccak/SHA-3 actually got (and is still getting) a lot of cryptanalysis, with papers published at renowned crypto conferences [1].

Keccak/SHA-3 is recognized to have a significant safety margin. E.g., one can cut the number of rounds in half (as in Keyak or KangarooTwelve) and still get a very strong function. I don't think we could say the same for SHA-256 or SHA-512…

Kind regards, Gilles, for the Keccak team

[1] https://keccak.team/third_party.html

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.