Subject: [Cfrg] Keccak worry?

From: Dan Brown <[email-masked]>
Date: Mon, 9 Nov 2015 12:44:32 +0000

ia.cr/2015/1085 describes a malicious variant of Keccak.

Should we now worry about Keccak?

---

From: Natanael <[email-masked]>
Date: Mon, 9 Nov 2015 14:58:04 +0100

> Should we now worry about Keccak?

All I know is that it reminds me of this:

https://malicioussha1.github.io/

---

From: Alexandre Anzala-Yamajako <[email-masked]>
Date: Mon, 9 Nov 2015 15:07:48 +0100

I guess the question is can you construct collisions "at will" or do you
use the round constants in your search of a high probability diff. path.
In the second case, you can use file formats magic  to transfor this
"single block collision" into something meaningful but that doesn't say
much about the targeted hash funciton.

---

From: Hanno Böck <[email-masked]>
Date: Mon, 9 Nov 2015 15:18:44 +0100

On Mon, 9 Nov 2015 12:44:32 +0000

> Should we now worry about Keccak?

One interesting question would be: In case Keccak would've been
submitted with those bad parameters - would've people noticed?

If people who participated in analyzing SHA3 candidates are reading
this: What do you think? Would you have spotted this?

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [email-masked]
GPG: BBB51E42

---

From: Thomas Peyrin <[email-masked]>
Date: Mon, 9 Nov 2015 22:35:19 +0800

Hi,

the constants for this attack have been chosen to meet a very special
property, that just fit so that some known attacks can be applied. This is
*not* the case with real Keccak constants.

Actually, there are probably a lot of cryptographic schemes for which if
you change some constants, you can easily break them (use different
constants in AES, for example constants that don't break the equal-columns
symmetry, and you can have trivial distinguishers). Now, that doesn't mean
at all that there is something malicious about these designs. Actually, I
think well designed cryptographic primitives tend to be easier to attack in
this malicious "change the constants" setting, because well designed
primitives are usually simple, with no extra useless layer: as soon as you
modify something (in this case, the constants), it breaks.

Cheers,

Thomas.

2015-11-09 22:18 GMT+08:00 Hanno Böck <[email-masked]>:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>
>