Given it only just got published, I imagine there's no public reference implementation yet? A quick search turned up empty, but I'd love to play with this. In particular, the conclusion drawn from slide 37 is important to me.
I'm pretty sure the algorithm has not been wholly (publicly) specified yet. Much of the hash tree structure is, as are parts of the compression function, but not the whole thing. Probably it will not be fully described until later this fall, closer to the NIST deadline.
I don't like the maximum height (L) parameter. While it might be useful to devices with very tiny (1-2kB) amount of memory, it unnecessarily parametrizes the hash, and MD6-256-3 and MD6-256-5 will be completely different hashes.
5 comments
[ 4.4 ms ] story [ 24.4 ms ] thread