Re: [Cfrg] Re: [saag] Bad day at the hash function factory

["D. J. Bernstein" <djb at cr.yp.to>]

Eric Rescorla writes:
> You can then demonstrate that the MAC/Hash is secure if the
> encryption algorithm has a bunch of (somewhat idealized) properties.

There's just one assumption needed for these proofs: namely, someone who
doesn't know the key k can't distinguish AES_k from a uniform random
permutation of the set of 16-byte strings. This was an explicit design
criterion for AES.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg