Slashdot Mirror
Now From Bruce Schneier, the Skein Hash Function
An anonymous reader writes "Bruce Schneier and company have created a new hash function called Skein. From his blog entry: 'NIST is holding a competition to replace the SHA family of hash functions, which have been increasingly under attack. (I wrote about an early NIST hash workshop here.) Skein is our submission (myself and seven others: Niels Ferguson, Stefan Lucks, Doug Whiting, Mihir Bellare, Tadayoshi Kohno, Jon Callas, and Jesse Walker). Here's the paper."
a skin rash function? WTF?!?
I had long feared that the skilled cryptographer Bruce Schneier, author of Applied Cryptography , had been utterly replaced by Bruce Schneier the security consultant who peddles his wares in all of his recent lightweight publications. It's nice to see the cryptographer return.
Read the title as "Skin Hash Function". For a moment, wasn't sure if this was a SFW article.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Reference: http://www.merriam-webster.com/dictionary/skein
http://www.schneier.com/skein.html
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
I love hearing about new functions, but the fundamental growth of the security industry has me concerned for the well-being of my cat -- HR director for a large corporation that shall remain nameless (although they dabble in web security). The growth of industry standards like SHA, typically stimulates additional growth in other market-based drives for change, and this is all pioneered by an industry that brought us the y2k bug, which was a total success. We made millions and did so in an unapologetic fashion. Keep em coming!
Summary: I want more money, so keep hacking and we'll keep thinking up ways to protect people from ourselves.
The dangers of knowledge trigger emotional distress in human beings.
How do we know he's not just spinning a good yarn here?
Certainly it's related to Blowfish and Twofish, but I cannot find a word one on Threefish outside of this document. Anyone care to explain for some good karma?
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Bruce is the friggin' man. He ought to get some kind of advisory role in the next administration. I think his views on security in general would help straighten out a lot of FUD...assuming that anyone in Washington would actually listen to him, that is. :)
Transistors and Beer!!
Disclaimer: I'm not a cryptographer, and I'm not a professional (anything). This post is based on my understanding, which may be wrong. Corrections accepted and welcomed.
Yes, MD5 is broken. Given a specific dataset with a specific MD5 hash, you can create another dataset with the same hash in minimal time (a few minutes on a modern computer).
You should thus not use MD5 to authenticate documents and other data as being "not-tampered with". As a checksum algorithm, it should not be used.
However, this is not the only use for hash functions. Hash functions are also used to obscure passwords. "Wait", I hear you say, "what about rainbow tables?". Wikipedia says (from the link above)
That's right folks, if you know what you are doing, you can still use MD5.
Basically, you have to salt your passwords before storing them in the DB (in case the DB gets broken into), send the original salt, and another (random) salt along with the login page, make sure that everyone hashes in the correct order and compare. Simplified, but I'm sure you're all intelligent enough to find what I'm talking about.
VoilÃ, a safe method of using MD5. (As far as I know, there is still no way to convert an MD5 hash back into the original text, or even a possible original text without using a Rainbow table.)
-----
That said, new hashing methods are always welcome. Especially when it comes to things like checksums. (I can't believe some websites still relay on MD5...)
I wank in the shower.
Funny, your website indicates the star trek pronunciation \'Skhaaaaaaaaan\
Quoted from the comments section
"Sooner or later some dumb ass is going to ask why Skein is based on Threefish, which was (apparently, according to the intertubes) broken."
Threefish can't possibly be broken yet; we only just announced it yesterday. No one knew of its existence before then.
I think your intertubes are clogged.
Posted by: Bruce Schneier at October 30, 2008 7:24 PM
Cryptography: Unique in computing in that it is a field where the so-called experts, really are experts
--modified from Jack Handy
first line of the pdf.... Niels Ferguson Microsoft Corp., niels@microsoft.com
from TFA:
"If you hashed 2^80 random messages, you'd find one pair that hashed to the same value. That's the "brute force" way of finding collisions, and it depends solely on the length of the hash value."
Seems to me like the Birthday Problem http://en.wikipedia.org/wiki/Birthday_problem says this is incorrect, and you'd require 2^80
Or is that assuming a Birthday hit?
Am I the only one that looks at Bruce and thinks Bearforce1?
This post climbed Mt. Washington.
Not enough rhyming collisions
You better watch out, there may be dogs about . .
BS made a good starters book, but with many errors. BS is not taken seriously on cryptography circles. I appreciate his work on pushing freedom for cryptography exports on US, but all his other work is irrelevant and gets publicity from his gestalt of self promotion.
..when they swerve to avoid Bruce Schneier!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Funny, your website indicates the star trek pronunciation \'Skhaaaaaaaaan\
It might in IPA, but Merriam-Webster's English-to-English dictionaries do not use IPA. Instead, they use a traditional English phonetic alphabet, where a-bar represents the "a" in "ace" or the "ey" in "they", spelled in X-SAMPA as [eI].
It's too bad Slashdot's character whitelist doesn't include anything with a macron; otherwise, this post would have been easier both to write and to read.
Oh what a Tangled Skein we weave.
When we first practice to Deceive.
A new hash has been designed
With File Security firm in mind.
With Threefish this Skein will defeat
Those who would infect and mistreat
One fish two fish red fish blue fishes :-]
Kiss my ass you scummy soap dishes.
Signed, Dr. Pseussdonym.
Inane Comments are Generously Disregarded
Personally, I'm waiting for the cypher built on Onefish, Twofish, Redfish, and Bluefish.
I do not like it encrypting my stocks,
I do not like it securing my box,
I do not like it, sam-I-am.
HA! I just wasted some of your bandwidth with a frivolous sig!
There are no finite state machines. There are only a series of states that Bruce Schneier allows to exist.
Bruce Schneier can tell you where to find your GPG key into the digits of PI.
Bruce Schneier owns a chicken that lays scrambled eggs. Whenever he wants a hard-boiled egg, he just unscrambles one.
SHA = "Schneier has access" SHA2 = "Schneier has access - and a spare too"
When transmitted over any socket, Bruce Schneier's public key causes libpcap to enter an infinite malloc loop.
Bruce Schneier knows Alice and Bob's shared secret.
Bruce Schneier's secure handshake is so strong, you won't be able to exchange keys with anyone else for days.
Bruce Schneier knows the state of schroedinger's cat
When Bruce Schneier observes a quantum particle, it remains in the same state until he has finished observing it.
Bruce Schneier once decrypted a box of AlphaBits.
http://geekz.co.uk/schneierfacts/
Skein-1024 is our ultra-conservative variant. Because it has twice the internal-state size of Skein-512, it is failure friendly; even if some future attack managed to break Skein-512, it is quite likely that Skein-1024 would remain secure. Skein-1024 can also run nearly twice as fast as Skein-512 in dedicated hardware implementations.
Can someone who understands this explain why you would ever use Skein-512 instead of Skein-1024?
I expect it will take a little while for NIST to compile all the submissions and put them online. In the meantime, someone has started compiling a list (which is unofficial and incomplete, but still useful):
http://131002.net/sha3lounge/
A PHP extension for the Skein hash is now available.
You can download it from:
http://download.pureftpd.org/php-skein-hash/
{{.sig}}
From Bruce Schneier? So what are those seven others?!
I hate it when people ignore many names for a single bigger name.
Persian Project Management Software as a Service
From Schneier:
Skein is defined for three different internal state sizesâ"256 bits, 512 bits, and 1024 bits [...]. A completely optional and extendable argument system makes Skein an efficient tool to use for a very large number of functions: [...] a stream cipher
So it does symmetric crypto with big keys [I assume the key size is either one internal state, or user-chosen].
Are there still crypto export laws in place? Would this impact Skein? Or will lawyers argue that encryption isn't it's primary purpose? Or...
It's also the Answer to Life, the Universe, and Everything (once you adjust for inflation, from 42).
The dangers of knowledge trigger emotional distress in human beings.
Personally I hope they just settle on Whirlpool. "The hash has been recommended by the NESSIE project. It has also been adopted by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as part of the joint ISO/IEC 10118-3 international standard." It's based on AES, patent-free wtih reference implementation in public domain and has been analyzed up and down already. But in all honesty, whatever's good enough for the NSA is probably good enough for me ;)
Live today, because you never know what tomorrow brings
For the crypto geeks, and those interested: look at the paper, section 2.5 "Optional arguments"
A Skein computation consists of processing these options in order, using UBI. Each input has a
different "type" value for the tweak, ensuring that inputs are not interchangeable.
Q: Couldn't you get the same effect for any other hash function?
A: Yes, I think. If there's extra data you want to tie to the message, come up with a type-length-value encoding scheme;
To tie a randomized hash value to the public key used to verify the signature, simply do H("nonce:64:" || the_nonce || "pubkey:1024:" || the_pubkey || "message:$length:" || the_message).
Or use numbers instead of names to identify types, and use fixed-sized words for lengths (or do unary encoding of the length of the length, then the length in binary). Just keep the tie-in function injective.
Can anyone see a fault in this?
Any block cipher can be used as a hash function in feedback mode.
(Also as a stream chiper - there's nothing they can't do!)
No sig today...
A one-time pad is pretty damn uncrackable, so long as the pad can be transferred without being intercepted, and quantum cryptography guarantees a message cannot be intercepted without you knowing. Thus, delivering one-time pads by quantum cryptography and then encrypting at most one message with that pad guarantees that the encryption cannot be broken. Well, unless the machine the pad is stored on is itself broken into, but you'd be stupid to provide an OTP keystore with Internet access or the root password on a sticky note on the monitor.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)