Slashdot Mirror
NIST Opens Competition for a New Hash Algorithm
Invisible Pink Unicorn writes "The National Institute of Standards and Technology has opened a public competition for the development of a new cryptographic hash algorithm, which will be called Secure Hash Algorithm-3 (SHA-3), and will augment the current algorithms specified in the Federal Information Processing Standard (FIPS) 180-2. This is in response to serious attacks reported in recent years against cryptographic hash algorithms, including SHA-1, and because SHA-1 and the SHA-2 family share a similar design. Submissions are being accepted through October 2008, and the competition timeline indicates that a winner will be announced in 2012."
i prefer the bubble bag method for making hash
Why does the government promote creating new encryption methods when encrypting data so clearly means you have something to hide and are therefore guilty? I mean COME ON!
I got a catholic block.
Encryption implies that you can reconstruct the original string from the encoded. Methods like md5, sha1, etc are one way algorithms that cannot be reversed* in a realistic amount of time.
* - Rainbow tables
Wah Sig!
Yes, and you'd spend most of your time trying to prove those algorithms are any good. That's the hard part anyhow, coming up with new algorithms isn't.
Error: password can't contain reverse spelling of ancient Chinese emperor
http://xkcd.com/257/
Not to mention that I sincerely doubt that anyone is currently using some super-secret ultra-elite hashing algorithm that no one else knows about. This field of mathematics and security is quite mature and very much open to scrutiny currently. The current solutions are fully documented. I think the point here is that further progress isn't going to be made by lone researchers hiding their results: the only way forward is via more open collaboration. What better way to get the methods than to have a 'competition', something that will stroke the egos of crackers? If a cracker wants to sell his secrets at the cost of an ego-stroke, that's his choice. Nothing nefarious here. Again, NIST is not going to take these results and use them for evil ends (or even for commercial gain): they are hoping to create an open, public standard that everyone will benefit from (and which international experts in mathematics, cryptography, and computer security will analyze in detail). That's what NIST does.
Sorry, but I think your paranoia is unfounded in this case!
(Disclosure: I work with NIST, but have nothing to do with this project. Note that my opinions are my own and should not be construed as official statements from NIST.)
Pay attention. You will be given a short string of characters that describes how to get from the prize to where you currently are, but from the directions it will be impossible to find your way back to the prize.
If you can claim to be the author of the US government standard cryptographic hash, you get to charge pretty much whatever you want in consulting fees.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Also done by NIST. I suppose you could be all paranoid and claim that AES was chosen so the that US government could snoop on you since, after all, the NSA signed off on it as being secure and they'd never tell the truth, right? Well, except for the fact that it was designed by a couple of Belgians and has also been signed off on by essentially every other respected crypto expert and organization there is.
So that leaves you with two possible situations:
1) That the NSA is so amazingly far ahead of everyone else in crypto that they were able to find something in AES that no one else has in over a decade. Also they are so confident in their knowledge that they believe nobody else will find it since if they did the results would be a big problem (AES is approved for classified data, and is used by US financial institutions).
or
2) AES is really secure, and the NSA is telling the truth.
Now which is more likely? Also, supposing you believe option #1 then why trust any crypto? If the NSA really is so good that they can outdo the entire rest of the crypto community, well then they can probably break pretty much any of the cryptosystems out there. You can't trust any of them since the only people who would really know if they were insecure won't say.
Seems extremely unlikely.
Well, same deal with this hash competition. If you believe that the government will be able to pick one that is in fact something they can break, but that nobody else in the world will know about this then it doesn't matter, because their understanding is so far advanced that all hashes would have to be suspect.
Given the extremely public, international, nature of things like this there really isn't any room for mistrust. I again point to the results of the AES competition. You want to talk about a cypher that has stood up to some extreme scrutiny, there you go.
If you cannot comprehend the string, assume the party escort submission position. A party representative will arrive shortly to escort you to your prize and a party celebrating your reception of said prize. There will be cake.