IETF Logo Mail Archive

Re: [Cfrg] Fwd: Hash-Based Key Derivation

"D. J. Bernstein" <djb@cr.yp.to> Tue, 25 October 2005 21:16 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUWAB-0004Jl-Hb; Tue, 25 Oct 2005 17:16:55 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUWAA-0004Hp-6Z for cfrg@megatron.ietf.org; Tue, 25 Oct 2005 17:16:54 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15262 for <cfrg@ietf.org>; Tue, 25 Oct 2005 17:16:38 -0400 (EDT)
Received: from stoneport.math.uic.edu ([131.193.178.160]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1EUWNB-0002Mm-7F for cfrg@ietf.org; Tue, 25 Oct 2005 17:30:22 -0400
Received: (qmail 8884 invoked by uid 1016); 25 Oct 2005 21:17:13 -0000
Date: Tue, 25 Oct 2005 21:17:13 -0000
Message-ID: <20051025211713.8883.qmail@cr.yp.to>
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.
From: "D. J. Bernstein" <djb@cr.yp.to>
To: cfrg@ietf.org
Subject: Re: [Cfrg] Fwd: Hash-Based Key Derivation
References: <200510252031.j9PKVq6U019725@taverner.CS.Berkeley.EDU>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

The standard ``Hash Diffie-Hellman'' security assumption simultaneously
handles (1) agreeing on a shared secret element of a group and (2)
deriving a secret key of whatever length from the group element.

It's _possible_ to choose really stupid hash functions that throw away
large parts of the apparent entropy of the group element, or that fail
to mangle the input at all, but these mistakes are obvious at a glance.
Nobody has ever had a problem with KDFs such as x |-> MD5(0,x),MD5(1,x)
inside hash-Diffie-Hellman.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email