[Cryptography] please dont weaken pre-image resistance of SHA3 (Re: NIST about to weaken SHA3?)

[Adam Back]

On Tue, Oct 15, 2013 at 03:09:58AM -0400, John Kelsey wrote:
>On Oct 14, 2013, at 4:17 PM, ianG <iang at iang.org> wrote:
>...
>> What is the preimage protection of SHA3-512 when truncated to 256?  It
>> seems that SHA3-384 still gets 256.
>
>If the capacity is c bits, then preimages are never more than 2^{c/2} bits. 
> So SHA3-512 as proposed in my CHES slides would have preimage resistance
> of 256 bits.

Are you including truncation in that?  (The question was would SHA3-512
STILL have 256-bit preimage security if it was truncated to 256-bit ie
motivated by a workaround to get a 256-bit output with conventional 256-bit
preimage resistance).

Adam