IETF Logo Mail Archive

Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

"D. J. Bernstein" <djb@cr.yp.to> Sat, 29 October 2005 10:44 UTC

Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EVoCk-0005ji-Nb; Sat, 29 Oct 2005 06:44:54 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EVoCi-0005gH-RP for cfrg@megatron.ietf.org; Sat, 29 Oct 2005 06:44:52 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA23915 for <cfrg@ietf.org>; Sat, 29 Oct 2005 06:44:35 -0400 (EDT)
Received: from stoneport.math.uic.edu ([131.193.178.160]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1EVoQS-0007c7-VV for cfrg@ietf.org; Sat, 29 Oct 2005 06:59:06 -0400
Received: (qmail 53191 invoked by uid 1016); 29 Oct 2005 10:45:13 -0000
Date: Sat, 29 Oct 2005 10:45:13 -0000
Message-ID: <20051029104513.53187.qmail@cr.yp.to>
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.
From: "D. J. Bernstein" <djb@cr.yp.to>
To: cfrg@ietf.org
Subject: Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)
References: <200510282223.j9SMN8Si014341@taverner.CS.Berkeley.EDU>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

David Wagner writes:
> Dan Bernstein writes:
> > You can turn AES into a hash function by applying, e.g., Luby-Rackoff
> > plus Miyaguchi-Preneel. Using this hash function to derive keys is then
> > identical to using AES to derive keys.
> Is it?  I don't see it.  AES-OMAC(K,X) is provably secure (as a PRF) assuming

Irrelevant. I said nothing about PRFs. I said that using a particular
hash function to derive keys is exactly the same as using AES to derive
keys. Rejecting the hash-based key-derivation function, but accepting
the identical AES-based key-derivation function, is blatantly idiotic.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email