Post by @hipsterelectron@circumstances.run

@hipsterelectron@circumstances.run 7 hr. ago

i'm heartbroken =',[ merkle how could you https://link.springer.com/content/pdf/10.1007/0-387-34805-0_40.pdf

While there has been a lively debate about the actual security level provided by DES[14.15,16,17] the fact remains that no major deviations from random behavior have been found.

shadow the hedgehog voice "what? this can't be....."

The existence of "random block ciphers" seems almost assured in some intuitive sense, and DES appears to be a reasonable approximation to one.

yeah that sounds good

15 Replies

2 Boosts

This comment is unavailable — it may have been deleted or is not visible to you.

d@nny disc@

@hipsterelectron@circumstances.run 52 min. ago

they describe how round 2 was different than round 1

https://drops.dagstuhl.de/entities/document/10.4230/DagSemProc.09031.17

The round function in the mill is very similar to that of Panama, except that the indexes are taken modulo 19 (instead of modulo 17).

The Road from Panama to Keccak via RadioGatún

d@nny disc@

@hipsterelectron@circumstances.run 50 min. ago

# Sponge functions?

they're trying so hard to make sponge functions a thing

d@nny disc@

@hipsterelectron@circumstances.run 49 min. ago

literally you look this shit up https://en.wikipedia.org/wiki/Sponge_function

algorithms with finite internal state that take an input bit stream of any length and produce an output bit stream of any desired length.

ah so it's a turing machine. you're describing a turing machine

Sponge function - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 48 min. ago

more specifically it's very obviously an attempt to dodge how finite-field diffie-hellman is still the best CSPRNG on the market

d@nny disc@

@hipsterelectron@circumstances.run 47 min. ago

In the sponge construction, the input is applied to and the output is extracted from the same part of the state. This is in fact essential for the simplicity of the indifferentiability proof of the sponge construction

i'm no crypto genious but this sounds wrong

d@nny disc@

@hipsterelectron@circumstances.run 36 min. ago

god fucking damn it. now i'm reading the maurer paper on indifferentiability and i feel this is just so obviously fucked now https://codeberg.org/cosmicexplorer/corporeal/src/branch/main/literature/maurer-indifferentiability-2003-161.pdf

The security of a cryptosystem C(S) involving a component S is typically proven by considering the cryptosystem C(T ) obtained from C(S) where the component S is replaced by an idealized component T.

yeah my cryptosystem would be soooooo secure if my components were replaced by spherical cows

The original system C(S) is secure if (a) the system C(T ) is secure, and (b) the component S is indistinguishable from T

see this is so clearly trying to pretend to be a polynomial-time reduction (WHICH DOES WORK!!!!) but it's WRONG

Cookie monster! (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 33 min. ago

omfg now read the very first line of SHA-3 explaining why they're sooooo spongey nao https://keccak.team/files/SpongeIndifferentiability.pdf

All cryptographic hash functions of any significance known today, i.e., MD4, MD5, the SHA and RIPEMD [15] families and several others, share the same design paradigm.

LMAO

They all consist of the iterated application of a compression
function.

NOT US!!! WE ARE THE BRAVE ONES WHO GO INTO BATTLE WITH ONLY A CRC

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 30 min. ago

During the last years, with
the recent collision attacks on SHA-1 as culminating point, it has become clear that designing a compression function that is both collision-resistant and efficient is not an easy task.

this is referring to the "compression function" that operates upon exactly one chunk of input at a time. it absolutely does NOT apply to generally "compressing" the bytes, since hash functions don't do that whatsoever.

but it sounds good right?

d@nny disc@

@hipsterelectron@circumstances.run 29 min. ago

Moreover, weaknesses have been shown in the Merkle-Damgård construction itself.

gasp! not my Merkle-Damgård construct!!! anything but my Merkle-Damgård!!!!!

d@nny disc@

@hipsterelectron@circumstances.run 27 min. ago

A well known example of such a weakness, discussed in [7], is the insecurity of the MAC function constructed from a Merkle-Damgård hash function by feeding the latter with the secret key followed by the message.

yeah cause it can leak the secret key not because it breaks the hash. this is SO unserious

d@nny disc@

@hipsterelectron@circumstances.run 26 min. ago

also they keep getting Merkle-Damgård wrong in the text layer it's decomposed into like `a or some shit. lliterally could not be exerting less effort

d@nny disc@

@hipsterelectron@circumstances.run 23 min. ago

wow i'm reading the maurer indifferentiability paper again and i cannot fucking believe this ever sounded good to me

d@nny disc@

@hipsterelectron@circumstances.run 21 min. ago

Together with its derived notion of reducibility (Section 5), it will allow for exactly the same general statements about the security of cryptosystems as the conventional definitions.

this line is the killer. the incredibly vapid and confusing proofs that reduce to a confusing-but-standard framework? they are absolutely not fucking necessary. they're actively obfuscatory

general statements about the security of cryptosystems

you literally cannot do this. it is not something you can achieve

d@nny disc@

@hipsterelectron@circumstances.run 19 min. ago

i really do wonder if several of the papers i've read today were composed with the authors like cackling over their incredibly mean-spirited april fool's day joke except people think this is real and they are gonna die

d@nny disc@

@hipsterelectron@circumstances.run 17 min. ago

For each of these constructions they provide theorems stating that if the compression function is constructed using an ideal component, i.e., a finite input length (FIL) random oracle or an ideal block cipher (used as Davies-Meyer compression function), the hash function behaves as a random oracle [3] with output truncated to a fixed length.

literally "if it's ideal, then it would be literally random"