RE: [Cfrg] Re: [saag] Bad day at the hash function factory

[Greg Rose <ggr at qualcomm.com>]

At 10:32 2004-08-26 -0700, Hallam-Baker, Phillip wrote:
> RC4 has been compromised by Shamir & co, but as a general rule I don't think
> any stream cipher should ever get a higher status than acceptable. A stream
> cipher always allows a person who has a plaintext and ciphertext
> corresponding to a key to encode or decode all messages with that key that
> are shorter or the same size. In effect all stream ciphers are vulnerable to
> a trivial form of known plaintext attack, the attack does not reveal the key
> but this is not necessary.

That's a completely bogus argument. The industry has already accepted that 
one needs to use block ciphers correctly (unpredictable random IVs, for 
example, and no ECB mode). Well, guess what, you need to use stream ciphers 
correctly too. That includes some kind of nonce mechanism. The 
new-generation stream ciphers (since NESSIE required it) all support 
Nonces, and usually with no hard-to-meet requirements about 
unpredictability. Efficiency always matters. So I don't think this position 
is justifiable.

Greg.

Greg Rose                                    INTERNET: ggr at qualcomm.com
Qualcomm Australia       VOICE:  +61-2-9817 4188   FAX: +61-2-9817 5199
Level 3, 230 Victoria Road,             http://people.qualcomm.com/ggr/
Gladesville NSW 2111/232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C


_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg