authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-07-20 01:59:24+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-07-19 23:59:24+00:00
log32aeb2c2ec09de78d9e2b9274015249b4994e160
tree3a3a8dbb47f4024af3dbf8fac0bc0aac5b825505
parentcec1e973b626ae6bd8ce1891537926e59c814463
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Be more conservative in the description of Aegis256Mac (#16452)

It is assumed that generating a collision requires more than 2^156 ciphertext modifications. This is plenty enough for any practical purposes, but it hasn't been proven to be >= 2^256. Be consistent and conservative here; just claim the same security as the other variants.

1 files changed, 1 insertions(+), 1 deletions(-)

lib/std/crypto/aegis.zig+1-1
......@@ -411,7 +411,7 @@ pub const Aegis128LMac = AegisMac(Aegis128L_256);
411411/// concern, the AEGIS-128L variant should be preferred.
412412/// AEGIS' large state, non-linearity and non-invertibility provides the
413413/// following properties:
414/// - 256 bit security against forgery.
414/// - More than 128 bit security against forgery.
415415/// - Recovering the secret key from the state would require ~2^256 attempts,
416416/// which is infeasible for any practical adversary.
417417/// - It has a large security margin against internal collisions.