@yrschrade@Arcium Cool! You might want to consider using TurboSHAKE instead of SHA-3. Same round function, but only 12 of them instead of 24. https://t.co/KRhxivWDdH
Xoodoo is too cool to fall for linear and differential cryptanalysis! New trail bounds for Xoodoo, a bug fix, and confirmations by an independent team of researchers. https://t.co/M0WHi7AGrW
@RichFelker It is not obvious indeed, but hopefully documented, see, e.g., https://t.co/twcgPbm0Nj (2012). The 32-bit implementations in the XKCP are all bit-interleaved.
@_rvklein_@oconnor663 Thanks for mentioning K12! Indeed, some clarifications about the performance of Keccak/SHA-3 may be worth reading: https://t.co/VxyMknnbIc
@xorhash@oconnor663 "Double invocation": actually the cost only amounts to an extra block to absorb the key. Also, HopMAC has interesting properties w.r.t. side-channel attacks.
@jedisct1@tylrtrmbl Note that it is not a tweak on Xoodyak, only on what we put behind the NIST API. The algorithm is given in Section 5 of the update document here: https://t.co/PT3MOcM4mI
@oconnor663@cryptodavidw@zooko Is efficiency the only relevant metric in symmetric crypto? :-) Anyway, efficiency goes beyond plain software speed and includes things less directly measurable, e.g., energy on dedicated circuits, protections against side-channel attacks.
@bascule@cryptodavidw "Garbage" is a strong word, but clearly I agree with you that the SHAKEs are the better instances of FIPS202. Hopefully now the idea of disentangling output sizes and security strength levels makes its way. Hence new projects should consider using XOFs instead of fixed hashes.
@jedisct1@tylrtrmbl What are the properties you have in mind? Sure they share the same 12×32 bits structure, but as far as diffusion is concerned, Xoodoo and Gimli take different approaches.