Subject: Re: [Cfrg] Who needs collision-resistance, anyway?

From: Bodo Moeller <[email-masked]>
Date: Mon, 4 Apr 2005 00:46:09 +0200

On Fri, Mar 18, 2005 at 04:56:32AM -0000, D. J. Bernstein wrote:

> [...]                    SHA-512 has been a standard for years, and is
> obviously vastly more difficult to break than MD5 and SHA-1. Can you
> explain why so few people are using it?

A very prosaic part of the answer is that while FIPS 180-2 (which
standardizes SHA-512) has become effective in February 2003, there is
no FIPS 182-3 yet (which would standardize the use of SHA-512
for DSA).  And similar inertness surely applies to other protocol
specifications and implementations.

>                                         Followup: Why would anyone
> choose SHA-256 rather than SHA-512?

This question appears more crucial in the context of the present
discussion, because SHA-256 and SHA-512 are equally new.  But it does
not have a single answer either.  One reason for choosing SHA-256
instead of SHA-512 (or SHA-1 instead of SHA-256, or indeed SHA-384
instead of SHA-512 or SHA-224 instead of SHA-256) is of course the
reduced length.  But this is not the only reason; there's also the
question of speed, and since SHA-512 is based on 64-bit words while
SHA-256 is based on 32-bit words, SHA-256 will often run faster than
SHA-512.  (And SHA-1 is yet faster.)

So, even with an additional 256-bit salt, SHA-256 would be more
efficient than SHA-512 without a salt is.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg