[61211] in cryptography@c2.net mail archive
Re: Can you keep a secret? This encrypted drive can...
daemon@ATHENA.MIT.EDU (Greg Rose)
Fri Nov 10 13:11:43 2006
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
In-Reply-To: <Pine.SOL.4.61.0611081746320.10678@mental>
Date: Wed, 8 Nov 2006 21:39:28 -0800
To: "Leichter, Jerry" <leichter_jerrold@emc.com>
From: Greg Rose <ggr@qualcomm.com>
Cc: "Travis H." <travis@nexus.subspacefield.org>,
Derek Atkins <warlord@mit.edu>, Saqib Ali <docbook.xml@gmail.com>,
Alexander Klimov <alserkli@inbox.ru>, cryptography@metzdowd.com,
krstic@solarsail.hcs.harvard.edu, smb@cs.columbia.edu,
adam@homeport.org, djm@mindrot.org, FDE@www.xml-dev.com
>At 17:58 -0500 2006/11/08, Leichter, Jerry wrote:
>No, SHA-1 is holding on (by a thread) because of differences in the
>details of the algorithm - details it shares with SHA-256. I
>don't think anyone will seriously argue that if SHA-1 is shown to
>be as vulnerable as we now know ND5 to be, then SHA-256 can still
>be taken to be safe for more than a fairly short time.
Hmm, I disagree with this. Firstly, I don't think SHA-1 *is* holding
on... while we don't have an example collision yet, there is no real
doubt that one can be found in about 2^64 operations, which is less
than the required 2^80. And SHA-2 does have a significantly different
design in one area; the data expansion part is much stronger than
SHA-1's, and almost certainly defeats the Wang-style attacks. Our
paper on eprint gives some justification for why SHA-2 would appear
to be resistant to these kinds of attacks.
Greg.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
