Subject: Re: [Ntp] [EXT] Comments on draft-ietf-ntp-roughtime-02

From: Ulrich Windl <[email-masked]>
Date: Sun, 14 Jun 2020 23:35:12 +0200

On 6/14/20 9:34 PM, Stuart Stock wrote:

[...]
> ## Stick with SHA-512; eliminate use of truncated SHA-512/256
> 
> Truncated SHA-512/256 is performed by a) compute SHA-512, then b) truncate the result.
> The resulting computational effort of SHA-512 and SHA-512/256 is equivalent.

I'm by no means a crypto-expert, but the "advantage" I see in using 
SHA-512/256 is that in 2^256-1 cases an attacker could think he/she 
guessed the right code when it's not true. Thus a possible attack could 
be identified maybe.

> 
> The draft utilizes SHA-512/256 for its 32 byte output, as opposed to 64 bytes for SHA-512. The
> motivation for this change is unclear as it complicates implementations which now need two
> hashing primitives (SHA-512/256 initialization parameters are different than SHA-512) without
> demonstrable performance or security benefit.

[...]

Regards,
Ulrich