Crypto hash algorithm competition set to begin

Security experts vying to have their technology selected as the next cryptographic-hash algorithm standard for the U.S. government need to submit their entries this week. Then they will have a long wait ahead: The new Secure Hash Algorithm standard isn't expected to be chosen until 2012.

A cryptographic hash algorithm is a marvel of ingenuity, allowing functions such as digital signatures, content verification and other security processes, including malware scanning. The current Secure Hash Algorithm (SHA) variants SHA-1 and SHA-2 aren't yet thought to be broken, but serious attacks against their core have been known for some time. With an eye on finding a better crypto hash algorithm, the National Institute of Standards and Technology (NIST) last year announced it's holding a competition to review public entries for a hoped-for new standard.

One contender, which was disclosed today, is "Skein," developed by Bruce Schneier with colleagues Niels Ferguson, Stefan Lucks, Doug Whiting, Mihir Bellare, Tadayoshi Kohno, Jon Callas and Jesse Walker.

Working together as friends, these security experts have jobs at Microsoft, Bauhaus-Universitat Weimar, BT Group, Hifn, the University of California, the University of Washington, PGP and Intel.

Although Skein may look like something from some "powerful industry consortium," its creators point out in their 75-page document submission that this is not the case.

"Our employers have kindly agreed to let us do this work, but most of it was done on our own time," Skein's creators say. "Really, they have only the vaguest idea what we're doing." The Skein collective adds: "We had lots of fun."

Skein "is really fast, really flexible," says Schneier, chief security technology officer of BT Group. "It's really simple and secure."

The Skein algorithm family works from 256-bit to 1,024-bit in strength, 512-bit representing the primary proposal. "Skein-256 is our low-memory variant," the Skein document states, while "Skein-1024 is our ultra-conservative variant." The block cipher at the core of Skein is called Threefish.

About 40 submissions in total are anticipated as entries in the NIST crypto hash algorithm contest. A tough public review of algorithm candidates will begin in earnest at a NIST conference next year. NIST's goal is to select a new hash standard in 2012 after a full public review of the finalists that manage to make it through the rigorous process of critical analysis from experts around the world.

NIST notes that such a lengthy process worked well in selecting the Advanced Encryption Standard back in 2002 as the more modern symmetric cipher to replace the aging Data Encryption Standard.