Re: [Cfrg] Internal collisions

[Bryan Ford <[e-mail]>]

Hi Dan,

> On Jul 31, 2015, at 6:36 PM, D. J. Bernstein <[e-mail]> wrote:
> 
> Security evaluation:
> 
>   * H(seed,M) followed by H(R,M): Collision-resilient. Serious defense
>     against the possibility of collisions in H.
> 
>   * H(seed,M) and in parallel H(M,R): _Not_ collision-resilient;
>     resilient only to external collisions, not internal collisions.
>     This is not much safer than simply using H(M).
> 
>   * H(M): Not collision-resilient.

I would like to hear your thoughts on how these security considerations change when H is not a traditional hash but a sponge-based hash, where the internal “pipe” state consists of both the ‘rate’ bits and the always-internal ‘capacity’ bits (say, chosen to be twice the security parameter).

In particular, I’d like to hear your thoughts on the security properties of my earlier ‘edshake’ proposal (see http://www.ietf.org/mail-archive/web/cfrg/current/msg07112.html <http://www.ietf.org/mail-archive/web/cfrg/current/msg07112.html>).  It seems to have nice performance characteristics for both small and large messages, and intuitively seems to have nice internal collision-resistance properties due to the sponge design, but I’m not an expert on security analysis of symmetric ciphers.

Thanks
Bryan