Comment by dathinab | Hacker News Reader

Comment by dathinab | Hacker News Reader

Parent Full thread

> which argues that we use too many rounds in symmetric constructions: our security margins are too high and don't match any of the best "practical" attacks. We're too paranoid for our own good. He suggests reducing the number of rounds for a number of constructions like AES, SHA-3, Blake2, etc.

This seems a quite dangerous way of thinking. New attacks, methods to attack crypto are discovered regularly. A view years ago people also said SHA-1 will never get broken to the degree it just got broken a recently.

So the only think we can do is to be slightly paranoid, everything else would be strongly negligent.

Especially if we consider how long it often takes in practice to update software and phase out previous encryption and hash methods without having to worry about e.g. downgrade attacks or similar.

Sure software should be possible to be updated asap, but honestly how long will it take until SHA-1 is phased out?

EDIT: Through that also means if you believe you will always be able update the _deployed_ relevant parts of your software ASAP (which can't work for libraries) and you are sure that you will follow the crypto community close enough and you believe some one else does so to if you are unavailable because of sickness, then yes go ahead and use less paranoid/secure crypto.

> This seems a quite dangerous way of thinking. New attacks, methods to attack crypto are discovered regularly.

He does actually address this counterargument in his paper. In fact most of his paper is a rebuttal to this argument (the status quo wisdom, so to speak).

This seems a quite dangerous way of thinking. New attacks, methods to attack crypto are discovered regularly.

It's not, really, because there is obviously some security margin that is too high. It makes a lot of sense to consider and try to quantify what that is. If all we have is some vague 'well, there are always new attacks' then how do we know the current margins are enough? Why not double the rounds, crank up the hash sizes, etc? It's not really a meaningful response to Aumasson's work.

1. As a community: Because you have to balance cost and security. Maybe we could increase them a bit without it stinging too much. But we can't do it boundlessly.

2. As an individual: Because I'd probably mess it up and pick a number of rounds that is e.g. divisible by 23 which weakens the system for some number theoretical reason that's far beyond my understanding.

I don't know what his arguments are, and I don't have much of a clue about crypto, but perhaps his argument could go along the lines of "a secure algorithm shouldn't be secured just by increasing the number of rounds too much"?

His argument is that since a cryptosystem has a set of different algorithms, each of which could compromise the whole system, the number of rounds should be chosen to match the margins across the primitives used, since strengthening one primitive does not improve the overall margins of the system.

Specifically at the end of the paper he argues that the choice of AES rounds is close to reasonable (and warrants little round reduction), and that ChaCha8 matches a reasonable number of rounds on AES (yielding a substantial 2.5x improvement in throughput vs. ChaCha20).

Following from these conclusions, I guess you could say that ChaCha12 is already quite ludicrously good, so ChaCha20 is downright wasteful. Not totally sure I agree yet with the specific numbers, but he makes a good point.

The paper also includes some helpful advice for those attempting to read cryptanalysis papers.

Agreed. We are not just securing for today, we are securing for perhaps decades into the future. If we don't know for sure what the threat is, then the right measure of paranoia is as much as we can afford.

We are not just securing ourselves, but our social network too. Something you do can be used to discredit your kids and grand-kids a long time from now.

Why not increase the rounds then? What makes the current security margins acceptable but not smaller margins?

I don't know a reason for why they are acceptable. AES256 is considered quantum-proof, but there exists another theoretical quantum computer design which seems to raise the bar again. I don't know if there exists a theoretical limit for how powerful quantum computers can get.

What other theoretical quantum design?

AES256 is considered quantum proof because grover's algorithm can in theory basically half they key size, and aes128 is secure on normal computers [we are still very very very very far away from a quantum computer that can use grover's algorithm to bruteforce aes128].

I'm not an expert on the subject but i believe a new quantum algorithm that could break aes256 would be a very major breakthrough in designing quantum algorithms.

The basic intuition behind symmetric cryptography is that once your input bits are "thoroughly mixed", there's no way to un-mix them besides brute-force.

On the other hand, we don't have a solid theory of computational complexity yet. Even basic questions like P = NP are still unanswered, so we have no idea what "thoroughly mixed" actually means, how to measure it, how to achieve it, or even if it exists.

Whatever it is, a single round of BLAKE certainly isn't "thoroughly mixed". Is 10 rounds enough? Nobody knows. On the other hand, we suspect that a thousand rounds are no better than a hundred - there's probably a plateau of "maximum entropy", and once you get there, extra mixing doesn't help.

So, since we don't actually know what we are doing, we pick a safety margin, like 1.4x or 2x, and just use that. It's all just guesswork until the theoretical side catches up, so your opinion is as good as mine. On the other hand, picking a safety margin of 1 seems rash. If you have practical attacks in the round before, you probably aren't anywhere near the plateau of maximum entropy!

Reply on news.ycombinator.com