IETF Logo Mail Archive

RE: [Cfrg] Fwd: Hash-Based Key Derivation

"Simon Blake-Wilson" <sblakewilson@bcisse.com> Tue, 25 October 2005 21:14 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUW7g-0000Nx-Am; Tue, 25 Oct 2005 17:14:20 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUW7e-0000Np-0o for cfrg@megatron.ietf.org; Tue, 25 Oct 2005 17:14:18 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15100 for <cfrg@ietf.org>; Tue, 25 Oct 2005 17:14:02 -0400 (EDT)
Received: from 209-204-118-122.sniparpa.net ([209.204.118.122] helo=bcisse.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EUWKd-0002HX-1e for cfrg@ietf.org; Tue, 25 Oct 2005 17:27:46 -0400
Received: from simon (toronto-HSE-ppp4158930.sympatico.ca [70.51.136.128]) by bcisse.com; Tue, 25 Oct 2005 17:11:29 -0400
From: Simon Blake-Wilson <sblakewilson@bcisse.com>
To: 'Tom Shrimpton' <teshrim@cs.pdx.edu>, cfrg@ietf.org
Subject: RE: [Cfrg] Fwd: Hash-Based Key Derivation
Date: Tue, 25 Oct 2005 17:11:23 -0400
Message-ID: <032801c5d9a8$a9a84ec0$0200a8c0@simon>
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.6626
In-Reply-To: <200510252058.j9PKwK5h003105@rigel.cs.pdx.edu>
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 3a4bc66230659131057bb68ed51598f8
Cc:
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0068495753=="
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

Right ... like I said at the start of this thread, I think the hard part
of KDF design is "the thing that turns an unpredictable value into a
pseudorandom value". Neither a PRF nor a MAC achieves this as far as I can
see ... The only thing which does it that has come up so far is a random
oracle ...

But a random oracle assumption seems like a pretty unsatisfactory solution
to the problem to me ... It feels like taking a heavy weight tool to solve
a light weight problem. And I suspect that both H(S|X) and PRF(H(S),X) are
good KDFs if H is a random oracle, so it doesn't help distinguish among
solutions as much as I'd like.

Best regards. Simon

> -----Original Message-----
> From: Tom Shrimpton [mailto:teshrim@cs.pdx.edu]
> Sent: Tuesday, October 25, 2005 4:58 PM
> To: 'Simon Blake-Wilson'; cfrg@ietf.org
> Subject: RE: [Cfrg] Fwd: Hash-Based Key Derivation
>
>
> > But a PRF also assumes random or pseudorandom, rather than
> > merely unpredictable input, doesn't it?
>
> Actually, a PRF makes no assumptions about the distribution
> of the inputs, but it does assume that the key is random and
> secret.  In some constructions, like the one that David
> suggested F(S,X) = SHA256-HMAC(SHA256(S), X) the key S
> effectively is part of the "input", so maybe this is what you mean?
>
> Cheers,
> Tom
>
>

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email