@forest Yes, but that doesn't mean that DJB designed Blake2. Once your algorithm (Salsa20) is in the public domain, anyone can do what they want with it
I suppose it's arguable that he played no non-negligible role in the design of blake2 due to designing Salsa20, but that's really a stretch/technicality
"designing" usually implies intent/a specific goal, I'm sure he didn't foresee the design of blake2
@EllaRose You're right. My point was that he played a major role in its design. Perhaps I should have said that he designed the algorithm which then went on to provide Blake2's security and become the core of the hash.
Kind of amusing: I think Bernstein attributed his inspiration for Salsa to the idea of using a hash function and counter to make a stream cipher. Specifically because he saw this as a trivial way to bypass crypto export laws, which required very weak ciphers but didn't restrict hash functions.
@forest Regarding your blake vs blake2 question, I think the author is one of those people who attribute a lot to analysis done for a competition and see almost any change from the spec submitted to the contest as dangerous because the new version is less scrutinized.
If you knew nothing about the security of blake it makes sense to be worried about it having fewer rounds AND being younger.
Of course there is a bit of inconsistency because kecak got changed too, if it is a fair accusation that he's thinking something like "change is automatically dangerous". But some people are just more comfortable with the voice of one authority so it's okay if NIST does it...
> After four years and one regulatory change, the Ninth Circuit Court of Appeals ruled that software source code was speech protected by the First Amendment and that the government's regulations preventing its publication were unconstitutional.
No disagreement. I meant trivial as in easy. Specifically building a cipher from only a hash algorithm and counter, and not the specific details of Salsa's permutation or Salsa's implications.
In retrospect it's obvious at least. Maybe it wasn't in the crypto dark ages. I read one of Schneier's books recommending CBC over CTR because at the time it was thought that CTR has the dangerous one and CBC was robust against block ciphers flaws... not the other way around.
Well they were correct, but they incorrectly estimated the relative risks. CBC can provide better diffusion than CTR (because the plaintext, which may not be known, is fed into the cipher), but CTR has the benefit of being entirely deterministic and not allowing the attacker to influence the internal state of the cipher. In the end it turned out that the risk of attacker-controlled input to the cipher was much higher than the risk of an attack against CTR that exploits the known input.
Known input vs attacker-controlled input. Though excluding padding oracle vulnerabilities and such and assuming authentication is used, CBC would technically be slightly more secure than CTR if the input cannot be controlled by an attacker.
Please flag spam posts as spam. Do not vandalize them. Do not close them. Do not mod-delete them. The post will be auto-deleted if it accumulates enough spam flags and will help train SE's anti-spam system.
(the no-vandalization is helpful so that people can easier decide whether a spam flag is appropriate without having to dive into the revision history)
In really urgent cases or when a post lingers for an extended period of time, ping a mod (e.g. me) here or if nobody is ping-able, ping a Information Security mod in their chat, they will be able to forward messages to us over an external, private channel.
Also spam-flags from mods are binding in a similar way as close- and delete-votes are.
And spam flags (IIRC) incur a hefty penalty on the poster (eg a big rep loss, potentially a question / answer ban)
The Side Channel
The Side Channel