[147672] in cryptography@c2.net mail archive
Re: [Cryptography] please dont weaken pre-image resistance of SHA3
daemon@ATHENA.MIT.EDU (John Kelsey)
Tue Oct 15 12:51:59 2013
X-Original-To: cryptography@metzdowd.com
In-Reply-To: <525C5166.9080301@iang.org>
From: John Kelsey <crypto.jmk@gmail.com>
Date: Tue, 15 Oct 2013 03:09:58 -0400
To: ianG <iang@iang.org>
Cc: Adam Back <adam@cypherspace.org>,
"cryptography@metzdowd.com" <cryptography@metzdowd.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
On Oct 14, 2013, at 4:17 PM, ianG <iang@iang.org> wrote:
...
> What is the preimage protection of SHA3-512 when truncated to 256? It seems that SHA3-384 still gets 256.
If the capacity is c bits, then preimages are never more than 2^{c/2} bits. So SHA3-512 as proposed in my CHES slides would have preimage resistance of 256 bits.
> iang
--John
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
