Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

[Ilari Liusvaara <[e-mail]>]

On Wed, Nov 16, 2016 at 02:22:24AM -0500, Russ Housley wrote:
> I’d like to summarize what I have heard.  Either SHA3-512 or
> SHAKE256-512 provide the necessary protection.  Both of these
> use Keccak, and both produce a 512-bit result.  SHAKE256 is
> more efficient.
> 
> I wrote a small test program, and it confirms that SHAKE256
> is more efficient than SHA3-512.

Note that from theoretical grounds, one gets that SHAKE256 is supposed
to have 89% higher throughput than SHA3-512 (or equivalently hashing
takes 47% less time) over long messages.

This if from the fact that SHAKE256 packs 136 data octets into each
block, whereas SHA3-512 only packs 72. And the algorithm to process
each block is the same. So SHAKE256 processes about 136 octets in the
same time as SHA3-512 processes 72.

The security level difference is in preimage resistance (512->256
bits), but 256 bit security level is more than sufficient here,
given that the curve is weaker than that.

Output length adjustment to "match security levels" is not helpful,
given that the block counts will be the same anyway.

Also, I hope that there is some envelope around the raw SHAKE256
result. Otherwise the result is the same as Ed448ph, except without
the TBS collision protection w.r.t. Ed448.


-Ilari