1 2 Speed, speed, speed $1000 TCR hashing competition D. J. Bernstein Crowley: “I have a problem where I need to make some University of Illinois at Chicago; cryptography faster, and I’m Ruhr University Bochum setting up a $1000 competition funded from my own pocket for Reporting some recent work towards the solution.” symmetric-speed discussions, Not fast enough: Signing H ( M ), especially from RWC 2020. where M is a long message. Not included in this talk: “[On a] 900MHz Cortex-A7 • NISTLWC. [SHA-256] takes 28.86 cpb : : : • Short inputs. BLAKE2b is nearly twice as • FHE/MPC ciphers. fast : : : However, this is still a lot slower than I’m happy with.”
1 2 eed, speed, speed $1000 TCR hashing competition Instead cho and sign Bernstein Crowley: “I have a problem where I need to make some Note that University of Illinois at Chicago; cryptography faster, and I’m not full collision University Bochum setting up a $1000 competition Does this funded from my own pocket for TCR bre rting some recent work towards the solution.” symmetric-speed discussions, Not fast enough: Signing H ( M ), ecially from RWC 2020. where M is a long message. included in this talk: “[On a] 900MHz Cortex-A7 NISTLWC. [SHA-256] takes 28.86 cpb : : : rt inputs. BLAKE2b is nearly twice as FHE/MPC ciphers. fast : : : However, this is still a lot slower than I’m happy with.”
1 2 eed $1000 TCR hashing competition Instead choose random and sign ( R; H ( R; Crowley: “I have a problem where I need to make some Note that H needs Illinois at Chicago; cryptography faster, and I’m not full collision resistance. Bochum setting up a $1000 competition Does this allow faster funded from my own pocket for TCR breaks how many recent work towards the solution.” discussions, Not fast enough: Signing H ( M ), WC 2020. where M is a long message. this talk: “[On a] 900MHz Cortex-A7 [SHA-256] takes 28.86 cpb : : : BLAKE2b is nearly twice as ciphers. fast : : : However, this is still a lot slower than I’m happy with.”
1 2 $1000 TCR hashing competition Instead choose random R and sign ( R; H ( R; M )). Crowley: “I have a problem where I need to make some Note that H needs only “TCR”, Chicago; cryptography faster, and I’m not full collision resistance. setting up a $1000 competition Does this allow faster H design? funded from my own pocket for TCR breaks how many rounds? work towards the solution.” discussions, Not fast enough: Signing H ( M ), 2020. where M is a long message. “[On a] 900MHz Cortex-A7 [SHA-256] takes 28.86 cpb : : : BLAKE2b is nearly twice as fast : : : However, this is still a lot slower than I’m happy with.”
2 3 $1000 TCR hashing competition Instead choose random R and sign ( R; H ( R; M )). Crowley: “I have a problem where I need to make some Note that H needs only “TCR”, cryptography faster, and I’m not full collision resistance. setting up a $1000 competition Does this allow faster H design? funded from my own pocket for TCR breaks how many rounds? work towards the solution.” Not fast enough: Signing H ( M ), where M is a long message. “[On a] 900MHz Cortex-A7 [SHA-256] takes 28.86 cpb : : : BLAKE2b is nearly twice as fast : : : However, this is still a lot slower than I’m happy with.”
2 3 $1000 TCR hashing competition Instead choose random R and sign ( R; H ( R; M )). Crowley: “I have a problem where I need to make some Note that H needs only “TCR”, cryptography faster, and I’m not full collision resistance. setting up a $1000 competition Does this allow faster H design? funded from my own pocket for TCR breaks how many rounds? work towards the solution.” “As far as I know, no-one Not fast enough: Signing H ( M ), has ever proposed a TCR as a where M is a long message. primitive, designed to be faster than existing hash functions, “[On a] 900MHz Cortex-A7 and that’s what I need.” [SHA-256] takes 28.86 cpb : : : BLAKE2b is nearly twice as fast : : : However, this is still a lot slower than I’m happy with.”
2 3 $1000 TCR hashing competition Instead choose random R and sign ( R; H ( R; M )). Crowley: “I have a problem where I need to make some Note that H needs only “TCR”, cryptography faster, and I’m not full collision resistance. setting up a $1000 competition Does this allow faster H design? funded from my own pocket for TCR breaks how many rounds? work towards the solution.” “As far as I know, no-one Not fast enough: Signing H ( M ), has ever proposed a TCR as a where M is a long message. primitive, designed to be faster than existing hash functions, “[On a] 900MHz Cortex-A7 and that’s what I need.” [SHA-256] takes 28.86 cpb : : : BLAKE2b is nearly twice as More desiderata: tree hash, fast : : : However, this is still a new tweak at each vertex, lot slower than I’m happy with.” multi-message security.
2 3 TCR hashing competition Instead choose random R Aumasson, and sign ( R; H ( R; M )). wley: “I have a problem 70%, 23%, I need to make some Note that H needs only “TCR”, 50%, 8%, cryptography faster, and I’m not full collision resistance. AES-128/B2b/ChaCha20/SHA-3 up a $1000 competition Does this allow faster H design? are “brok from my own pocket for TCR breaks how many rounds? “Inconsistent towards the solution.” “As far as I know, no-one fast enough: Signing H ( M ), has ever proposed a TCR as a M is a long message. primitive, designed to be faster than existing hash functions, a] 900MHz Cortex-A7 and that’s what I need.” [SHA-256] takes 28.86 cpb : : : BLAKE2b is nearly twice as More desiderata: tree hash, : However, this is still a new tweak at each vertex, wer than I’m happy with.” multi-message security.
2 3 hashing competition Instead choose random R Aumasson, “Too much and sign ( R; H ( R; M )). have a problem 70%, 23%, 35%, 21% make some Note that H needs only “TCR”, 50%, 8%, 25%, 20% faster, and I’m not full collision resistance. AES-128/B2b/ChaCha20/SHA-3 $1000 competition Does this allow faster H design? are “broken” or “p own pocket for TCR breaks how many rounds? “Inconsistent securit the solution.” “As far as I know, no-one enough: Signing H ( M ), has ever proposed a TCR as a long message. primitive, designed to be faster than existing hash functions, Cortex-A7 and that’s what I need.” 28.86 cpb : : : rly twice as More desiderata: tree hash, ever, this is still a new tweak at each vertex, I’m happy with.” multi-message security.
2 3 etition Instead choose random R Aumasson, “Too much crypto” and sign ( R; H ( R; M )). roblem 70%, 23%, 35%, 21% rounds some Note that H needs only “TCR”, 50%, 8%, 25%, 20% rounds I’m not full collision resistance. AES-128/B2b/ChaCha20/SHA-3 etition Does this allow faster H design? are “broken” or “practically et for TCR breaks how many rounds? “Inconsistent security margins”. solution.” “As far as I know, no-one H ( M ), has ever proposed a TCR as a message. primitive, designed to be faster than existing hash functions, rtex-A7 and that’s what I need.” : : : as More desiderata: tree hash, still a new tweak at each vertex, with.” multi-message security.
3 4 Instead choose random R Aumasson, “Too much crypto” and sign ( R; H ( R; M )). 70%, 23%, 35%, 21% rounds or Note that H needs only “TCR”, 50%, 8%, 25%, 20% rounds of not full collision resistance. AES-128/B2b/ChaCha20/SHA-3 Does this allow faster H design? are “broken” or “practically broken”. TCR breaks how many rounds? “Inconsistent security margins”. “As far as I know, no-one has ever proposed a TCR as a primitive, designed to be faster than existing hash functions, and that’s what I need.” More desiderata: tree hash, new tweak at each vertex, multi-message security.
3 4 Instead choose random R Aumasson, “Too much crypto” and sign ( R; H ( R; M )). 70%, 23%, 35%, 21% rounds or Note that H needs only “TCR”, 50%, 8%, 25%, 20% rounds of not full collision resistance. AES-128/B2b/ChaCha20/SHA-3 Does this allow faster H design? are “broken” or “practically broken”. TCR breaks how many rounds? “Inconsistent security margins”. “As far as I know, no-one “Attacks don’t really get better”. has ever proposed a TCR as a primitive, designed to be faster than existing hash functions, and that’s what I need.” More desiderata: tree hash, new tweak at each vertex, multi-message security.
3 4 Instead choose random R Aumasson, “Too much crypto” and sign ( R; H ( R; M )). 70%, 23%, 35%, 21% rounds or Note that H needs only “TCR”, 50%, 8%, 25%, 20% rounds of not full collision resistance. AES-128/B2b/ChaCha20/SHA-3 Does this allow faster H design? are “broken” or “practically broken”. TCR breaks how many rounds? “Inconsistent security margins”. “As far as I know, no-one “Attacks don’t really get better”. has ever proposed a TCR as a “Thousands of papers, stagnating primitive, designed to be faster results and techniques”. than existing hash functions, and that’s what I need.” More desiderata: tree hash, new tweak at each vertex, multi-message security.
Recommend
More recommend
