Den Mon, 22 Feb 2016 10:08:32 +0100 skrev Re: Curve25519/448 key agreement for SSH: > "Mark D. Baushke" <mdb%juniper.net@localhost> writes: > > > If so, why is the Key Exchange Method name "curve448-sha256" rather > > than "curve488-sha512" ? > > I think Damien Miller's argument for using sha512 here makes sense: > "curve448 is a backup against as-yet-unknown attacks on curve25519. > Since we're not likely to need it, we might as well pair it with > SHA512 as a backup against as-yet-unknown attacks on SHA256." Hello Mark and Niels. Indeed there appears to be strong support from several people to couple Curve448 with SHA-512 instead of SHA-256. We are making this change and there will be a -04 out shortly. Mark's RFC quoting is a strong reason to make this change, but I believe there were sufficient motivation to do it anyway because of the hedge aspect. /Simon
Attachment:
pgp36EYp43LgA.pgp
Description: OpenPGP digital signatur