Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

John Kelsey writes:
> I think the thing you're both missing here is the ways these
> primitives can be attacked.  Hash functions are easier to attack,
> because in general, you can't assume any secrets from the attacker,

No. The thing you're missing here---see the subject line---is that we
are talking about how to build key-derivation functions. When MD5 or
SHA-256 or an AES-based function is used to derive keys, there _is_ an
input kept secret from the attacker, namely a Diffie-Hellman g^xy.

The security of a key-derivation function is _not_ equivalent to
collision resistance. It is _not_ equivalent to the PRF property. It is
_not_ equivalent to universality, randomness extraction, etc. All of
these are interesting topics, but they are distractions from the topic
at hand, namely key derivation.

Certainly the cryptographic community has had some spectacular failures
to design collision-resistant hash functions. But secure key derivation
is a completely different problem. Statements such as ``many of our hash
functions aren't collision-resistant, so they aren't safe key-derivation
functions'' are obviously silly.

You're adding to the confusion if you use the ambiguous word ``secure''
and say things like ``secure hash functions are hard to design'' rather
than ``collision-resistant hash functions are hard to design.'' People
saying things like ``secure hash functions are hard to design, so we
can't use hash functions for key derivation'' don't seem to realize that
they're bouncing between two completely different security notions.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg