Subject: Re: [openpgp] V5 Fingerprint again

From: "Derek Atkins" <[email-masked]>
Date: Wed, 01 Mar 2017 19:12:20 -0500

Because the SHA3 competition showed us that SHA2 is a good hash...  and SHA2 is much faster than SHA3.

-derek

Sent from my mobile device. Please excuse any typos.

----- Reply message -----
From: "Leo Gaspard" <[email-masked]>
To: <[email-masked]>
Subject: [openpgp] V5 Fingerprint again
Date: Wed, Mar 1, 2017 6:27 PM

On 03/01/2017 06:30 PM, Phillip Hallam-Baker wrote:
> H(x) = SHA-2-512(x)

Hoping this hasn't been discussed before, but... is there a reason for
not picking SHA3-512? (or SHAKE256 with 25*8 bits of output if willing
to stay at 25 octets for the fingerprint)

This should push back the next required switch to a v6 key.

---

From: Leo Gaspard <[email-masked]>
Date: Thu, 2 Mar 2017 11:33:46 +0100

> SHA2 is much faster than SHA3.

Not being a cryptographer I can't tell much about SHA2's security, but I
was told even if there is no flaw found at the moment in SHA2 the
construction it is based on (Merkle-Damgard) is the same as for MD5 and
SHA1 and has started to show some weaknesses, while SHA3 is based on the
sponge construction, which may be more secure.

As for the speed, if I read [1] correctly (which, granted, isn't a
given), SHA2 isn't "much faster" than SHA3, as keccak512 is faster than
sha256 while keccak1024 is slower than sha512 (for equivalent security).

[1] https://bench.cr.yp.to/results-sha3.html

---

From: KellerFuchs <[email-masked]>
Date: Fri, 3 Mar 2017 17:12:36 +0000

On Wed, Mar 01, 2017 at 07:12:20PM -0500, Derek Atkins wrote:
> On  Wed, Mar 1, 2017 6:27 PM, Leo Gaspard <[email-masked]> wrote:

BLAKE2 is faster than either (2-3× faster than SHA-2, depending on configuration,
and about 3-5× faster than SHA-3), and designed for ease-of-implementation on a
variety of platforms, and was standardized as [RFC 7693].

It's widely-regarded as secure; quoting the SHA-3 final report [0]:

> BLAKE and Keccak have very large security margins. [...]
> Skein and BLAKE have no known distinguishing attacks that come close to threatening their
> full-round versions.  Grøstl, Skein, and BLAKE have a large number of attack papers reflecting
> considerable depth of analysis.

Moreover, quite a few projects already picked it as their hash function of
choice, due to said advantages, so there is existing library support and
we can likely expect that to be true for quite some time.

In that context, is there something I missed which says
we can't have our cake and eat it too?

Best,

  kf

[0]: http://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf
[RFC 7693]: https://tools.ietf.org/html/rfc7693

> _______________________________________________
> openpgp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/openpgp