Hacker News Reader

Comment by dchest | Hacker News Reader

Shots fired.

Here's an tweet from Jean-Philippe Aumasson, one of the authors of BLAKE(2) (uses ChaCha ARX construction) and NORX (uses modified ChaCha replacing addition with an approximation based on XOR, AND, shift operations):

"where @KeccakTeam misses a big point: MD5 and SHA-1 got broken because of Boolean operations (AND/OR), not because of ARX operations" https://twitter.com/veorq/status/910255284920180736

View on HN

Ok but, in reply to that tweet, one point keccak.team make, which seems valid for non-classified cryptanalysis, is that researchers don't invest time in trying to analyse ARX because the propagation of addition makes it too complicated.

One thing I got from that is that ARX designs are less likely to be broken, not because they are necessarily more secure, but because ARX is often less analysed than designs which yield more concise mathematical representations.

I think there's an implication here of "less likely to be broken by public research".

That would be getting causality backwards.

I have no idea what you mean.

Exactly, ARX's less analyzed complexity is a potential information asymmetry arbitrage for serious attackers.

Shots fired indeed, although the 132-character argument is a bit of a straw man; the original argument was that using ARX operations in cryptographic primitives makes it harder to analyze the primitive, regardless of whether the actual weakness is in a boolean or an ARX operation.

Agreed. No contradiction. keccak.team does not say ARX is broken, only harder to analyze (and slow in HW, and getting obsoleted).

Well, AND and OR "lose information" more than XOR

x.0 is 0 and x+1 is 1 (to use combinational logic notation)

Now XOR(x,y) depend on x and y and there are no values that cause the other value to be ignored

I also think the point they make about speed is kinda picking at straws, it's valid for an FPGA, but not so much for a CPU

Reply on news.ycombinator.com