Re: [Cfrg] Keccak worry?

Hi,

the constants for this attack have been chosen to meet a very special
property, that just fit so that some known attacks can be applied. This is
*not* the case with real Keccak constants.

Actually, there are probably a lot of cryptographic schemes for which if
you change some constants, you can easily break them (use different
constants in AES, for example constants that don't break the equal-columns
symmetry, and you can have trivial distinguishers). Now, that doesn't mean
at all that there is something malicious about these designs. Actually, I
think well designed cryptographic primitives tend to be easier to attack in
this malicious "change the constants" setting, because well designed
primitives are usually simple, with no extra useless layer: as soon as you
modify something (in this case, the constants), it breaks.

Cheers,

Thomas.

2015-11-09 22:18 GMT+08:00 Hanno Böck <hanno@hboeck.de>:

> On Mon, 9 Nov 2015 12:44:32 +0000
> Dan Brown <dbrown@certicom.com> wrote:
>
> > ia.cr/2015/1085 describes a malicious variant of Keccak.
> >
> > Should we now worry about Keccak?
>
> One interesting question would be: In case Keccak would've been
> submitted with those bad parameters - would've people noticed?
>
> If people who participated in analyzing SHA3 candidates are reading
> this: What do you think? Would you have spotted this?
>
> cu,
> --
> Hanno Böck
> http://hboeck.de/
>
> mail/jabber: hanno@hboeck.de
> GPG: BBB51E42
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
>