IETF Logo Mail Archive

RE: [Cfrg] Fwd: Hash-Based Key Derivation

"Blumenthal, Uri" <uri.blumenthal@intel.com> Tue, 25 October 2005 19:22 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUUNS-0004LU-Gi; Tue, 25 Oct 2005 15:22:30 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUUNQ-0004L8-N1 for cfrg@megatron.ietf.org; Tue, 25 Oct 2005 15:22:28 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14013 for <cfrg@ietf.org>; Tue, 25 Oct 2005 15:22:13 -0400 (EDT)
Received: from fmr13.intel.com ([192.55.52.67] helo=fmsfmr001.fm.intel.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EUUaP-0006vX-NL for cfrg@ietf.org; Tue, 25 Oct 2005 15:35:55 -0400
Received: from fmsfmr101.fm.intel.com (fmsfmr101.fm.intel.com [10.253.24.21]) by fmsfmr001.fm.intel.com (8.12.10/8.12.10/d: major-outer.mc, v 1.1 2004/09/17 17:50:56 root Exp $) with ESMTP id j9PJMAIC024003 for <cfrg@ietf.org>; Tue, 25 Oct 2005 19:22:12 GMT
Received: from fmsmsxvs040.fm.intel.com (fmsmsxvs040.fm.intel.com [132.233.42.124]) by fmsfmr101.fm.intel.com (8.12.10/8.12.10/d: major-inner.mc, v 1.2 2004/09/17 18:05:01 root Exp $) with SMTP id j9PJLuGU017104 for <cfrg@ietf.org>; Tue, 25 Oct 2005 19:22:10 GMT
Received: from fmsmsx331.amr.corp.intel.com ([132.233.42.156]) by fmsmsxvs040.fm.intel.com (SAVSMTP 3.1.7.47) with SMTP id M2005102512221012335 for <cfrg@ietf.org>; Tue, 25 Oct 2005 12:22:10 -0700
Received: from fmsmsx311.amr.corp.intel.com ([132.233.42.214]) by fmsmsx331.amr.corp.intel.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 25 Oct 2005 12:22:10 -0700
Received: from hdsmsx402.amr.corp.intel.com ([10.127.2.62]) by fmsmsx311.amr.corp.intel.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 25 Oct 2005 12:22:09 -0700
Received: from pysmsx401.amr.corp.intel.com ([146.152.3.156]) by hdsmsx402.amr.corp.intel.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 25 Oct 2005 15:22:09 -0400
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Subject: RE: [Cfrg] Fwd: Hash-Based Key Derivation
Date: Tue, 25 Oct 2005 15:21:05 -0400
Message-ID: <3DEC199BD7489643817ECA151F7C5929020EEBB0@pysmsx401.amr.corp.intel.com>
Thread-Topic: [Cfrg] Fwd: Hash-Based Key Derivation
Thread-Index: AcXZmNCGGkX2NgNMQXiHtvLEs/2WpQAAA1Gw
From: "Blumenthal, Uri" <uri.blumenthal@intel.com>
To: cfrg@ietf.org
X-OriginalArrivalTime: 25 Oct 2005 19:22:09.0028 (UTC) FILETIME=[648F8C40:01C5D999]
X-Scanned-By: MIMEDefang 2.52 on 10.253.24.21
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b
Content-Transfer-Encoding: quoted-printable
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

> Is there a proof somewhere that pre-hashing then MACing makes a good
KDF?

AFAIK - such a proof does not exist (yet?). 

Regarding hash - some people claim, that based on their experience,
crypto-hash output is "random enough". I personally find it somewhat
"unscientific". :-)

> I'd be interested to see it. 

Me too.

> -----Original Message-----
> From: cfrg-bounces@ietf.org [mailto:cfrg-bounces@ietf.org] On 
> Behalf Of David Wagner
> Sent: Tuesday, October 25, 2005 2:41 PM
> To: cfrg@ietf.org
> Subject: [Cfrg] Fwd: Hash-Based Key Derivation
> 
> 
> Simon Blake-Wilson writes:
> >Is it really true that you can build a KDF like this based 
> on standard 
> >assumptions about a MAC? [...] MACs are by design secure only if the
> >key is pseudorandom, aren't they?
> 
> Yes, in general, you are right.  The fix is to pre-hash the 
> key. So you might use F(S,X) = SHA256-HMAC(SHA256(S), X), 
> where S is the secret.
> 
> For HMAC, it might just happen to be the case that 
> pre-hashing is unnecessary -- I don't know, and I haven't 
> tried to do the analysis.
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg
> 

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email