Subject: [Cfrg] Re: SHA Code

From: Charanjit Jutla <[email-masked]>
Date: Fri, 12 Aug 2005 11:08:06 -0400

Hi David,

Yes, you are right, for i=16 to 19, that term cant be there, so a 
case statement has to be there.  The reason that extra term is there in the first place is to make the proving of the lower bound easier.... if you read through the end of the Intuition section,,, maybe we managed to explain it.

We also have some candidates which do not have this case statement, but the analysis is going to be more complex, and the computer assisted search may run into 10 days instead of current one day. I think as the community gets more comfortable with this whole approach, we can try to converge to a code which is comfortable to all. For example Lisa Yin has suggested that we try to get rid of the i-20 term and just prove a lowerbound of 60 (instead of 80). So, there are many options, and it is not clear right now, what is the best thing to do. See the last section of the paper of other alternatives.

Yes, we will definitely provide test vectors for this shortly. As for testing
the proof, we can provide pseudocode, so people can implement it. We have actually written testers for our programs , so as to make sure we are not writing
buggy programs.

Finally, there is this issue of replacing the Message Expsnsion code in SHA-256 as well, and we have candidates for that too (which can be proven).

You are right about the FIPS -180-1 statement you made, and we will make that change. We have submitted this paper to NIST, so hopefully we get enough time to explain it to a knowledgeable audience.

Charanjit

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: David McGrew <[email-masked]>
Date: Fri, 12 Aug 2005 08:46:36 -0700

Charanjit,

On Aug 12, 2005, at 8:08 AM, Charanjit Jutla wrote:

> case statement has to be there.  The reason that extra term is there 
> in the first place is to make the proving of the lower bound 
> easier.... if you read through the end of the Intuition section,,, 
> maybe we managed to explain it.
>
> We also have some candidates which do not have this case statement, 
> but the analysis is going to be more complex, and the computer 
> assisted search may run into 10 days instead of current one day. I 
> think as the community gets more comfortable with this whole approach, 
> we can try to converge to a code which is comfortable to all. For 
> example Lisa Yin has suggested that we try to get rid of the i-20 term 
> and just prove a lowerbound of 60 (instead of 80). So, there are many 
> options, and it is not clear right now, what is the best thing to do. 
> See the last section of the paper of other alternatives.

thanks, will do.  Sounds like there will be a good discussion at the 
NIST workshop.

David

> the proof, we can provide pseudocode, so people can implement it. We 
> have actually written testers for our programs , so as to make sure we 
> are not writing
> buggy programs.
>
> Finally, there is this issue of replacing the Message Expsnsion code 
> in SHA-256 as well, and we have candidates for that too (which can be 
> proven).
>
> You are right about the FIPS -180-1 statement you made, and we will 
> make that change. We have submitted this paper to NIST, so hopefully 
> we get enough time to explain it to a knowledgeable audience.
>
> Charanjit
>