RE: [Cfrg] Fwd: Hash-Based Key Derivation

Thanks David ... interesting stuff. You clearly have a clear idea of what
you think a KDF does in terms of security, but I guess I'd still like to
see a convincing formal defintion. (I guess this is hard to do since
"convincing" implies that the definition somehow helps convert an insecure
key establishment protocol into a secure one.)

Also if making random oracle model assumptions is OK, then the definition
in the I-D is also likely to be good, isn't it? For example, won't H(S|X)
also be a good KDF if H is assumed to be a random oracle?

Best regards. Simon

> -----Original Message-----
> From: cfrg-bounces@ietf.org [mailto:cfrg-bounces@ietf.org] On
> Behalf Of David Wagner
> Sent: Tuesday, October 25, 2005 3:48 PM
> To: cfrg@ietf.org
> Subject: [Cfrg] Fwd: Hash-Based Key Derivation
>
>
> Simon Blake-Wilson writes:
> >Is there a proof somewhere that pre-hashing then MACing makes a good
> >KDF?
>
> In the random oracle model, it is easy to prove that
> pre-hashing then applying a PRF makes a good PRF.  In other words, let
>     F'(S,X) = F(H(S),X)
> where F is a PRF (when its key-input is uniformly
> distributed) and H is a random oracle.  Then F' is a PRF,
> even when its secret-input S is not uniformly distributed, so
> long as S has sufficient min-entropy.  Finally, the latter is
> all you need to build a good KDF.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg
>

RE: [Cfrg] Fwd: Hash-Based Key Derivation

Attachment: smime.p7s