15 ms·
Cryptographic hash functions, by contrast, are not well understood at all. They are "magic" in many ways, and aren't modeled after anything. Many more "bad thin
by cdavidcash 15y ago
Cryptographic hash functions, by contrast, are not well understood at all. They are "magic" in many ways, and aren't modeled after anything. Many more "bad things" happen in this space than in the block cipher space.
Is this a common opinion amongst practitioners? The opposite philosophy (e.g., that a random oracle is a "weaker object" than an ideal cipher) underlies some lines of work in the theoretical cryptography literature.
- tptacek 15y agoYes, it's a common opinion (I quoted Schneier on it downthread).
- pbsd 15y agoThe two models are equivalent, in fact: http://eprint.iacr.org/2008/246 http://eprint.iacr.org/2008/246 This of course says nothing about how to go about building an actual cipher/hash that withstands all kinds of cryptanalysis. Edit: apparently not so clear, I'm told: http://arxiv.org/abs/1011.1264 http://arxiv.org/abs/1011.1264
- davidcash 15y agoA better interpretation of that paper is that it is giving an upper [edit: upper bound] on how inequivalent the models are. Also, that paper was subsequently shown to be fatally flawed. http://arxiv.org/abs/1011.1264 http://arxiv.org/abs/1011.1264 Anyway, yeah, a theoretical diversion.