[Cryptography] please dont weaken pre-image resistance of SHA3 (Re: NIST about to weaken SHA3?)

[John Kelsey]

On Oct 14, 2013, at 4:17 PM, ianG <iang at iang.org> wrote:
...
> What is the preimage protection of SHA3-512 when truncated to 256?  It seems that SHA3-384 still gets 256.

If the capacity is c bits, then preimages are never more than 2^{c/2} bits.  So SHA3-512 as proposed in my CHES slides would have preimage resistance of 256 bits.  

> iang

--John