Hacker News Reader

I know I’m comparing oranges to apples here as these functions are not well suited for cryptographic operations, but how does the measured “bias” affect cryptanalysis? Can someone familiar with differential cryptography explain if a hash function with a lower bias defeats cryptanalysis with lower rounds or with less compute? Will this thing help find better cryptographic hash functions?

View on HN

This bias testing is essentially ruling out candidates with very high probability truncated differentials of Hamming weight 1. In a cryptographic primitive you want to rule out _all_ high-probability differentials, which requires different methods. You also want to rule out other high-probability statistical distinguishing properties, such as linear approximations, higher-order differentials, etc.

That being said, this sort of quick-and-dirty testing is useful to filter out obviously bad candidates at the early design phase of, say, an ARX primitive.

> Will this thing help find better cryptographic hash functions?

Very, very unlikely.

Reply on news.ycombinator.com