[Cfrg] Fwd: Hash-Based Key Derivation

[David Wagner <[e-mail]>]

>> I wanted call your attention to an individual draft on "Hash-Based  
>> Key Derivation."
>>       http://www.ietf.org/internet-drafts/draft-dang-nistkdf-00.txt

General: The document doesn't specify how integers are to be encoded.
Little-endian?  Big-endian?  It seems to me that protocols that reference
this spec should be required to specify the encoding of integers into
bit-strings.

2.1.2: algorithmOID is variable-length, but there is no length field
prepended to it.  It seems like this omission should be remedied.

2.1.4: The size of keydatalen is not specified.  It should be.

2.1.6: I'm not entirely certain about the requirement that "protocols
SHOULD support multiple hashes"; perhaps that SHOULD should be a MAY.

2.2: I agree that the spec should probably be using a PRF (e.g., H-HMAC)
rather than a plain hash (H), and probably should be pre-hashing the secret
value with H (depending upon the properties of the PRF).

4: Should there be some discussion about the dangers of hash negotiation
(e.g., that your security against active attacks might degrade to that
of the weakest hash supported)?

In general, it looks like a useful standard.  It has a few little
rough edges, but they can easily be smoothed off.

_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg