Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

[John Wilkinson <[e-mail]>]

On Oct 29, 2005, at 10:06 AM, Jack Lloyd wrote:

> On Sat, Oct 29, 2005 at 09:08:42AM -0400, John Wilkinson wrote:
>
>>
>> On Oct 28, 2005, at 6:15 PM, D. J. Bernstein wrote:
>>
>>> You can turn AES into a hash function by applying, e.g., Luby- 
>>> Rackoff
>>> plus Miyaguchi-Preneel. Using this hash function to derive keys is
>>> then
>>> identical to using AES to derive keys.
>>>
>>
>> Dr. Bernstein, could you please describe (or give reference to) a way
>> to produce a hash function H from AES, such that HMAC-H is a provably
>> secure PRF, based only on the assumption that AES is a secure PRP?
>> Thanks. -John
>>
>
> The paper "Black-Box Anylsis of the Block-Cipher-Based Hash-Function
> Constructions from PGV" from Crypto '02 (by Black, Rogaway, Shrimpton)
> would seem to get us there. If AES is an ideal cipher, then we know
> the collision and inversion resistance properties of various AES-based
> hashing schemes thanks to that paper.

That AES is an ideal cipher is a much bigger assumption than that AES  
is a secure PRP. Dr. Bernstein stated that there is a way to make a  
hash function from AES such that deriving keys using that hash  
function is "identical" to deriving keys using, say, CMAC-AES. I am  
curious as to what method he has in mind. -John


_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg