Subject: RE: [Cfrg] Who agree with building block cipher, hash, MAC with same round function and key schedulel

From: "Blumenthal, Uri" <[email-masked]>
Date: Wed, 2 Aug 2006 17:10:29 -0400

Dan, GOST uses 256-bit key (and has always been this way). It doesn't
accept 128-bit or 192-bit keys.

Not mentioning that S-boxes were supposed to be secret (giving extra 512
bits).

-----Original Message-----
From: Dan Harkins [mailto:[email-masked]] 
Sent: Wednesday, August 02, 2006 4:43 PM
To: Blumenthal, Uri
Cc: [email-masked]
Subject: RE: [Cfrg] Who agree with building block cipher, hash, MAC with
same round function and key schedulel

  Hi Uri,

  GOST takes a 64 bit key. A device was built for less than $1 million
that cracks DES using brute force in less than a day. So why couldn't
a similar one crack GOST in 256 days (or less given Moore's law)? I
find it hard to believe that a piece of hardware can be built for less
that $1 million that could crack AES in that amount of time.

  Can you expound on your statement that GOST "compares to AES in
strength".

  Dan.

> This is what Russians have done. And from what I see, their old
> cryptographic school is like their ballet - without competition. :-)
>
> Russian cryptographic suite (Encryption, MAC, Hash) is based on
> old-but-still-strong block cipher GOST 28147, and their Digital
> Signature standard is based on Elliptic Curve Crypto.
>
> Block cipher that Russians base their symmetric key (and keyless - aka
> hash) algorithms compares to AES in strengh. Its weaknesses are:
64-bit
> block size, and simplistic key schedule. The first weakness is due to
> algorithm's age (end of 70-ties?), the second one I suspect to be a
> design compromise. Designers sacrificed strong key schedule for
greater
> key agility. This becomes important when you build hash out of block
> cipher.
>
> It is illustrative to observe how they approached hash design.
Americans
> took an idea of block cipher, figured that full strength is not needed
> and simplified the heck out of it - and then put together gazillion of
> rounds to compensate for the overly simplistic round function.
Russians
> took a real full-strength block cipher, and considering that full
> strength is not needed - truncated the number of rounds. So encrypting
> GOST is 32 rounds, while hashing GOST is "only" 16.
>
>
>
> ________________________________
>
> 	From: duo lei [mailto:[email-masked]]
> 	Sent: Wednesday, August 02, 2006 2:16 AM
> 	To: [email-masked]
> 	Subject: [Cfrg] Who agree with building block cipher, hash,MAC
> with same round function and key schedulel
>
>
> 	Dear all:
>
> 	     In the paper http://eprint.iacr.org/2006/147, titled "New
> 	Integrated proof Method on Iterated Hash Structure and New
> Structures
> 	", the author give an integrated proof method on security proof
> of
> 	iterated hash structure. Based on the proof method, one  can
> 	distinguish the security of Merkel-Damag{\aa}rd structure,
> wide-pipe
> 	hash, double-pipe hash and 3c hash, the paper also give a new
> recommend
> 	structure.
>
> 	At last, a new hash called F-hash, MAC called F-MAC and
> encryption
> 	model Called FBC-mode are given,  based on same block cipher
> round
> 	function and key schedule algorithm, which means with a same
> block
> 	cipher round function and key schedule algorithm, we can have a
> Hash,
> 	MAC and block cipher and Encryption Mode, the proof based
> knowledge of
> 	that was based on security of Feistel structure. The AES with
> 256 bits
> 	key and plaintext (called Rijndael) is good selection.
>
>
>
> 	Who agree with the point of  considering using same round
> function and key schedule
> 	algorithm to build a block cipher, MAC and Hash.
>
> 	best regards.
> 	                       Duo Lei
>
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
>

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 2 Aug 2006 14:43:31 -0700 (PDT)

Hi Uri,

  That was my misunderstanding. Thanks for straightening me out.

  Dan.

---

From: Greg Rose <[email-masked]>
Date: Wed, 2 Aug 2006 15:11:37 -0700

>accept 128-bit or 192-bit keys.

Length (of key) isn't everything. As someone pointed out, block size 
does matter.

>Not mentioning that S-boxes were supposed to be secret (giving extra 512

This is bogus. It's a secret that can be reverse engineered out of 
any device or software implementation, and has to be given out to 
anyone who needs to implement it. I don't believe this counts.

Greg.