Re: Hash algorithm analysis

Hi,

On 10/06/18 00:49, brian m. carlson wrote:

I imported the optimized 64-bit implementation of KangarooTwelve. The
AVX2 implementation was not considered for licensing reasons (it's
partially generated from external code, which falls foul of the GPL's
"preferred form for modifications" rule).

Indeed part of the AVX2 code in the Keccak code package is an extension
of the implementation in OpenSSL (written by Andy Polyakov). The
assembly code is generated by a Perl script, and we extended it to fit
in the KCP's internal API.

Would it solve this licensing problem if we remap our extensions to the
Perl script, which would then become "the source"?


On 12/06/18 00:35, brian m. carlson wrote:

quoted

My understanding is that all the algorithms we're discussing are
believed to be approximately equivalent in security. That's a strange
thing to say when e.g. K12 uses fewer rounds than SHA3 of the same
permutation, but it is my understanding nonetheless. We don't know
yet how these hash algorithms will ultimately break. 

With the exception of variations in preimage security, I expect that's
correct. I think implementation availability and performance are the
best candidates for consideration.

Note that we recently updated the paper on K12 (accepted at ACNS 2018),
with more details on performance and security.
https://eprint.iacr.org/2016/770

quoted

My understanding of the discussion so far:

Keccak team encourages us[1] to consider a variant like K12 instead
of SHA3. 

While I think K12 is an interesting algorithm, I'm not sure we're
going to get as good of performance out of it as we might want due to
the lack of implementations.

Implementation availability is indeed important. The effort to transform
an implementation of SHAKE128 into one of K12 is limited due to the
reuse of their main components (round function, sponge construction). So
the availability of SHA-3/Keccak implementations can benefit that of K12
if there is sufficient interest. E.g., the SHA-3/Keccak instructions in
ARMv8.2 can speed up K12 as well.

Kind regards,
Gilles