Re: [saag] AD sponsoring draft-josefsson-scrypt-kdf

[Kathleen Moriarty <[e-mail]>]

On Thu, Aug 13, 2015 at 10:24 AM, Simon Josefsson <[e-mail]> wrote:
> Kathleen Moriarty <[e-mail]> writes:
>
>> On Thu, Aug 13, 2015 at 7:48 AM, Nikos Mavrogiannopoulos
>> <[e-mail]> wrote:
>>> On Thu, Aug 13, 2015 at 12:39 AM, Simon Josefsson <[e-mail]> wrote:
>>>> DES-based UNIX Crypt-function,
>>>> FreeBSD MD5 crypt,
>>>> GNU SHA-256/512 crypt
>>>> Windows NT LAN Manager (NTLM) hash
>>>> Blowfish-based bcrypt
>>>
>>> The latter was published in USENIX 1999:
>>> https://www.usenix.org/legacy/event/usenix99/provos/provos.pdf
>>>
>>>> As far as I know, Salsa20 was not published at any conference or
>>>> journal, so there may not be any better references.
>>>
>>> Salsa20 was an official submission to estream competition, so the
>>> authoritative reference is the design articles at:
>>> http://www.ecrypt.eu.org/stream/salsa20pf.html (the "Salsa20
>>> specification" and "Salsa20 design").
>>
>> I'd jut like to take a step back from the reference question to ask,
>> why is salsa used as a hash when it was designed as a stream cipher?
>
> This is a terminology issue.  'Salsa20 core' or 'Salsa20 hash' is
> explained here:
>
> http://cr.yp.to/salsa20.html
>
> Salsa20 core is a hash function, in its general sense, see:
>
> https://en.wikipedia.org/wiki/Hash_function
>
> In particular, Salsa20 core is NOT a cryptographic hash function.
> Compare Salsa20 core to FNV or CRC or something similar, not to SHA-1.
>
> Salsa20 the stream cipher is based on the Salsa20 core hash function.
>
> Scrypt does not use Salsa20 the stream cipher.
>
> Think of the Salsa20 hash function as similar to FNV hash.
>
> This said, I'm not convinced the estream Salsa20 specification is the
> most suitable reference to explain the Salsa20 core hash function.  The
> eSTREAM site linked above only appear to publish a ZIP file with the
> algorithm specification.  Is that a good reference?  However, perhaps we
> can add it as an additional reference?  Then there is always the worry
> about which is the "right" one in case of differences, but since the
> draft includes test vectors I doubt there will be any confusion.
>
>> Is there a reason Blake2 (derived from chacha) was not used instead?
>
> 1) Scrypt needs a (fast) mathematic hash function, not a cryptographic
> hash.
>
> 2) Age; ChaCha and Scrypt were designed at the same time.
>
>> Maybe there is a good reason and I'd be interested to have that
>> background.
>
> I hope this helps.

Thanks, I was just taking a quick look at this because of the reference problem.
>
> /Simon



-- 

Best regards,
Kathleen