Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This seems a quite dangerous way of thinking. New attacks, methods to attack crypto are discovered regularly.

It's not, really, because there is obviously some security margin that is too high. It makes a lot of sense to consider and try to quantify what that is. If all we have is some vague 'well, there are always new attacks' then how do we know the current margins are enough? Why not double the rounds, crank up the hash sizes, etc? It's not really a meaningful response to Aumasson's work.



1. As a community: Because you have to balance cost and security. Maybe we could increase them a bit without it stinging too much. But we can't do it boundlessly.

2. As an individual: Because I'd probably mess it up and pick a number of rounds that is e.g. divisible by 23 which weakens the system for some number theoretical reason that's far beyond my understanding.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: