Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The NIST contests are great, but I would expect that running such a contest for a hash or a cipher is easier than doing so for most protocols. It is possible to define exactly what a cryptographic hash must do in order to be considered a cryptographic hash. I think one would have a harder time making an analogous characterization of the solution space for HTTP security.

Whatever eventually replaces TLS, I doubt it will be something that could have emerged from a limited-duration contest.



NIST has weighed in on how to use TLS: http://tools.ietf.org/html/rfc6460

I am not aware of any proposed attacks on the approved cipher suites that are anywhere near feasible. TLS deployment is far behind known best practice. We should do something about that.


For sure! I was responding more to the lament that TLS is different from e.g. SHA3. As I see it, this difference is inevitable.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: