Subject: Re: [saag] Improving the CHAP protocol

From: "Dang, Quynh (Fed)" <[email-masked]>
Date: Sat, 5 Oct 2019 11:21:45 +0000

Hi all,

SHAKE128/256 is about 25% faster than SHA3-256. They both have the same level of collision resistance strength: 128 bits.

In a MAC mode (such as KMAC), SHAKE128 has 256 bits of security if the MAC key has at least 256 bits of security and the tag (output size) is at least 256 bits, for practical purposes.

https://keccak.team/2017/is_sha3_slow.html gives performance information about SHAKEs (Keccak). The site has a lot of other information about Keccak.

SHAKE128/256 is not a NIST-approved hash function for general uses. NIST will evaluate each use case of SHAKE128 and/or SHAKE256 when requested, then make a decision whether or not such use case is allowed.

Regards,
Quynh.
________________________________
From: saag <[email-masked]> on behalf of John Mattsson <john.mattsson=[email-masked]>
Sent: Thursday, September 26, 2019 3:45 AM
To: Mark D. Baushke <mdb=[email-masked]>; Jim Schaad <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: Re: [saag] Improving the CHAP protocol

I would also prefer SHAKE compared to SHA3-256. I think SHAKE128 offer enough security for the foreseeable future, but just SHAKE256 may be better if we want a single algorithm to fulfil 256-bit security requirements from e.g. governments. Do/will any constrained IoT devices use CHAP? Then their requirements should be taken into account.

/John

-----Original Message-----
From: saag <[email-masked]> on behalf of "Mark D. Baushke" <mdb=[email-masked]>
Date: Wednesday, 25 September 2019 at 21:11
To: Jim Schaad <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [saag] Improving the CHAP protocol

    Jim Schaad <[email-masked]> writes:

    > If you do that, I don't know if you want SHA3-256 or SHAKE. SHAKE
    > seems to be used more from what I have seen so far.

    I think SHAKE256 is the better entry in my opinion if you want something
    for the future.

    I believe you will find implementations in popular crypto libraries
    (provided in alphabetical order) such as Bouncy Castle, Crypto++,
    Libgcrypt, and OpenSSL.

         -- Mark

    _______________________________________________
    saag mailing list
    [email-masked]
    https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag&amp;data=02%7C01%7Cquynh.dang%40nist.gov%7C8ac8ec7163fc4d0e38d608d742559cce%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637050807783734465&amp;sdata=UYupbWuiuo2Xysd%2BFTYsNPj4scK14C0v0vNPIvSJrnM%3D&amp;reserved=0

_______________________________________________
saag mailing list
[email-masked]
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsaag&amp;data=02%7C01%7Cquynh.dang%40nist.gov%7C8ac8ec7163fc4d0e38d608d742559cce%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637050807783744472&amp;sdata=%2Fvogrn2BoNojJGWZtinoMDGbbIjvgLWEoOXN%2BnBFLqw%3D&amp;reserved=0