Re: [Cfrg] Answers to HKDF questions

[Hugo Krawczyk <[e-mail]>]

I do not know what you mean by "better randomizer" so I cannot answer the
question.
I can answer why it is a better extractor which is what the whole paper is
about.

One result you may want to take a look at is Coron et al. Ref [17] in my
paper.
They show something that I use but is not specific to KDFs.

They prove that HMAC (think of it as a mode of operation acting on
Merkle-Damgard functions) is random-oracle-preserving, while Merkle-Damgard
alone is not (as clearly demonstrated by extension attacks).

You can think of it as an indication that HMAC is a better
randomness-preserving function than the plain hash.
Maybe that is what you mean by "better randomizer"?

Hugo

On Thu, Oct 22, 2009 at 7:19 PM, Blumenthal, Uri <[e-mail]> wrote:

>  Actually one thing I don't think I found in the paper that Hugo referred
> to, was why HMAC-SHA is a better *Randomizer* than SHA. Why HMAC is better
> than say keyed SHA is clear.
>
> Would you care to clarify this?
>
> ------------------------------
>  *From*: [e-mail] <[e-mail]>
> *To*: Zooko Wilcox-O'Hearn <[e-mail]>
> *Cc*: [e-mail] <[e-mail]>
> *Sent*: Thu Oct 22 19:09:32 2009
> *Subject*: Re: [Cfrg] Answers to HKDF questions
>
>
>
> On Wed, Oct 21, 2009 at 11:01 PM, Zooko Wilcox-O'Hearn <[e-mail]>wrote:
>
>> Dear Hugo Krawcyck:
>>
>> Thank you for the detailed answers.  I still have a question about HMAC as
>> compared to other MACs.  Feel free to point me to existing documents if they
>> answer my question.  Suppose I were to instantiate HKDF with the keyed PRF
>> being a cipher based MAC such as Poly1305 instead of HMAC.  Which of the
>> arguments for HKDF's security would still apply?
>>
>>
> To answer these questions I need to ask you some questions myself:
>
> Can you explain how do you plan to use poly1305 for KDF.
> Is it as an extractor, or for key expansion or both? You say as a "keyed
> PRF": how do you get a PRF out of your MAC and where does the key to the PRF
> come from?
> Are you going to use only the universal hash part of poly1305 or the whole
> construction?
> If the latter, where does the key for AES come from?
>
> In general a MAC function does not imply a good KDF. Even a good PRF does
> not.
> (If that was the case it would have been much easier to argue that HMAC is
> a good basis for KDF).
>
> If you give me more details on what you mean by your "MAC-based KDF" I can
> try to answer more specifically.
>
> Hugo
>
>