Re: [saag] AD sponsoring draft-josefsson-scrypt-kdf

[Simon Josefsson <[e-mail]>]

Kathleen Moriarty <[e-mail]> writes:

> On Thu, Aug 13, 2015 at 7:48 AM, Nikos Mavrogiannopoulos
> <[e-mail]> wrote:
>> On Thu, Aug 13, 2015 at 12:39 AM, Simon Josefsson <[e-mail]> wrote:
>>> DES-based UNIX Crypt-function,
>>> FreeBSD MD5 crypt,
>>> GNU SHA-256/512 crypt
>>> Windows NT LAN Manager (NTLM) hash
>>> Blowfish-based bcrypt
>>
>> The latter was published in USENIX 1999:
>> https://www.usenix.org/legacy/event/usenix99/provos/provos.pdf
>>
>>> As far as I know, Salsa20 was not published at any conference or
>>> journal, so there may not be any better references.
>>
>> Salsa20 was an official submission to estream competition, so the
>> authoritative reference is the design articles at:
>> http://www.ecrypt.eu.org/stream/salsa20pf.html (the "Salsa20
>> specification" and "Salsa20 design").
>
> I'd jut like to take a step back from the reference question to ask,
> why is salsa used as a hash when it was designed as a stream cipher?

This is a terminology issue.  'Salsa20 core' or 'Salsa20 hash' is
explained here:

http://cr.yp.to/salsa20.html

Salsa20 core is a hash function, in its general sense, see:

https://en.wikipedia.org/wiki/Hash_function

In particular, Salsa20 core is NOT a cryptographic hash function.
Compare Salsa20 core to FNV or CRC or something similar, not to SHA-1.

Salsa20 the stream cipher is based on the Salsa20 core hash function.

Scrypt does not use Salsa20 the stream cipher.

Think of the Salsa20 hash function as similar to FNV hash.

This said, I'm not convinced the estream Salsa20 specification is the
most suitable reference to explain the Salsa20 core hash function.  The
eSTREAM site linked above only appear to publish a ZIP file with the
algorithm specification.  Is that a good reference?  However, perhaps we
can add it as an additional reference?  Then there is always the worry
about which is the "right" one in case of differences, but since the
draft includes test vectors I doubt there will be any confusion.

> Is there a reason Blake2 (derived from chacha) was not used instead?

1) Scrypt needs a (fast) mathematic hash function, not a cryptographic
hash.

2) Age; ChaCha and Scrypt were designed at the same time.

> Maybe there is a good reason and I'd be interested to have that
> background.

I hope this helps.

/Simon