Subject: Re: [Cfrg] draft-irtf-cfrg-eddsa-00

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Wed, 14 Oct 2015 15:37:52 +0000

+1

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Peter Schwabe
Sent: Wednesday, October 14, 2015 09:19
To: Gilles Van Assche
Cc: [email-masked]
Subject: Re: [Cfrg] draft-irtf-cfrg-eddsa-00

Gilles Van Assche <[email-masked]> wrote:
> Hi all,

Dear all,

> Indeed, as noted by several people, using an extendable-output function
> (XOF) like SHAKE128 or SHAKE256 is rather natural and results into
> simpler (and cleaner IMHO) definitions.

I fully agree with Gilles here. It's true that Keccak is slower in
software than, e.g., Blake 2, but when compared to SHA-512, there's not
much of a difference, except if SHA-512 has hardware acceleration [1]. 
As much as I like fast crypto, I think that simplicity is more
important.

Some people have argued that SHA-3 is complex to implement in software,
but actually, an implementation of all 6 algorithms of the FIPS-202
standard fits into just 9 tweets:
http://keccak.noekeon.org/tweetfips202.html

Best regards,

Peter

[1] http://bench.cr.yp.to/results-sha3.html