Re: [Cfrg] Re: AES-based hash function

[John Viega <viega at securesoftware.com>]

On Fri, Sep 03, 2004 at 07:12:04AM +1000, Greg Rose wrote:
> 
> I second Shai. In fact, look at the structure of the things that were all 
> just broken... they *are* block ciphers, used in Merkle-Damgard mode. The 
> data is used as the key, the chaining variables are the block, and the data 
> expansion phase is just a key-scheduling operation. The only way they 
> differ from things like AES is that more emphasis was placed on fast key 
> scheduling, since it changes for every block.

If you look at it from the perspective of SHA-1 using a block cipher
internally, The block cipher internal to SHA-1 is actually used in the
exact same mode that MDC-2 uses as its building block
(Matayas-Meyer-Oseas).  Doesn't this imply that, if this is the
paradigm even for traditional OWHFs, that we should focus on trying to
make block ciphers suitable replacements for ideal ciphers?  And isn't
AES much farther down that path than the internals of anything based
off MD4?

John

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg