286 karma · joined September 13, 2015
e.g. the Chacha20 design document explains the choices made in a fairly high level and easy to understand way: https://cr.yp.to/chacha/chacha-20080128.pdf
Yeah, sure, I'll get right on that
Performance has nothing to do with whether a hash function is "cryptographic"
> I know that BLAKE received some scrutiny in this regard
BLAKE was one of the most, if not _the_ most, analyzed SHA3 entries.
"Keccak received a significant amount of cryptanalysis, although not quite the depth of analysis applied to BLAKE, Grøstl, or Skein"
https://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf
> making the claims to security less and less sensible.
BLAKE2/3 are not completely new algorithms. They fine tune features from the previous version to be more lightweight while still remaining cryptographically sound
> The SHA3 security margin can safely be decreased, as NIST set the security requirements too high. This is one of the reasons for the speed difference.
BLAKE and Keccak have roughly equal security margins, which is one reason why BLAKE2/3 can still be secure while being faster than BLAKE.
> This means that Blake's security would be less sure even had it received the same level of scrutiny.
So since it arguably received more, does that balance things out?
Addition being slower in hardware and much more expensive to mask against side channels is a serious argument against ARX constructions, but that isn't really relevant here
effects don't matter, making money matters