Gilles Van Assche

Enthusiastic member of @KeccakTeam — cryptographer at ST — professor at Université Libre de Bruxelles ad interim

[Gilles Van Assche @docgcrypto]

@yrschrade @Arcium Cool! You might want to consider using TurboSHAKE instead of SHA-3. Same round function, but only 12 of them instead of 24. https://t.co/KRhxivWDdH

[Gilles Van Assche @docgcrypto]

@jedisct1 You are free to define anything you want, but personally I prefer and recommend to stick to 12 rounds.

[Gilles Van Assche @docgcrypto]

@jedisct1 @KeccakTeam Nice! "Parallel" means "using threads", right?

[The Keccak Team @KeccakTeam]

RFC 9861: TurboSHAKE and KangarooTwelve, the fast alternatives to SHA-3 and SHAKE
https://t.co/TdW5wvA2h6

[Gilles Van Assche @docgcrypto]

@cronokirby It is not usual that you can halve the number of rounds of a standard primitive and still get comfortable safety margin. 😀

[Gilles Van Assche @docgcrypto]

@mjos_crypto Then how to improve XKCP? Feel free to review/give suggestions here: https://t.co/vmIKBPu3TT

[The Keccak Team @KeccakTeam]

Interested in permutation-based crypto? Be sure to submit your abstract or paper before February 28! Call for papers: https://t.co/hRONiPGEgs

[The Keccak Team @KeccakTeam]

The future of symmetric cryptography: modes built on deck functions instead of block ciphers! https://t.co/WjPQruVf7Y

[Lionel Rivière @mangeurdpommes]

@KeccakTeam 🤣 That’s a way to say non ADD, ROT, XOR!

[The Keccak Team @KeccakTeam]

What's this? https://t.co/Q5xDMXa7JN

[The Keccak Team @KeccakTeam]

Xoodoo is too cool to fall for linear and differential cryptanalysis! New trail bounds for Xoodoo, a bug fix, and confirmations by an independent team of researchers. https://t.co/M0WHi7AGrW

[Gilles Van Assche @docgcrypto]

@RichFelker It is not obvious indeed, but hopefully documented, see, e.g., https://t.co/twcgPbm0Nj (2012). The 32-bit implementations in the XKCP are all bit-interleaved.

[Gilles Van Assche @docgcrypto]

@_rvklein_ @oconnor663 Thanks for mentioning K12! Indeed, some clarifications about the performance of Keccak/SHA-3 may be worth reading: https://t.co/VxyMknnbIc

[Gilles Van Assche @docgcrypto]

@jedisct1 @tylrtrmbl More the second option, unless the nonce is too long of course.

[Gilles Van Assche @docgcrypto]

@xorhash @oconnor663 "Double invocation": actually the cost only amounts to an extra block to absorb the key. Also, HopMAC has interesting properties w.r.t. side-channel attacks.

[Gilles Van Assche @docgcrypto]

@jedisct1 @tylrtrmbl Note that it is not a tweak on Xoodyak, only on what we put behind the NIST API. The algorithm is given in Section 5 of the update document here: https://t.co/PT3MOcM4mI

[Gilles Van Assche @docgcrypto]

@oconnor663 @cryptodavidw @zooko Is efficiency the only relevant metric in symmetric crypto? :-) Anyway, efficiency goes beyond plain software speed and includes things less directly measurable, e.g., energy on dedicated circuits, protections against side-channel attacks.

[Gilles Van Assche @docgcrypto]

@bascule @cryptodavidw "Garbage" is a strong word, but clearly I agree with you that the SHAKEs are the better instances of FIPS202. Hopefully now the idea of disentangling output sizes and security strength levels makes its way. Hence new projects should consider using XOFs instead of fixed hashes.

[Gilles Van Assche @docgcrypto]

@jedisct1 @tylrtrmbl What are the properties you have in mind? Sure they share the same 12×32 bits structure, but as far as diffusion is concerned, Xoodoo and Gimli take different approaches.