Re: [Cfrg] Answers to HKDF questions

["Blumenthal, Uri" <[e-mail]>]

Actually one thing I don't think I found in the paper that Hugo referred to, was why HMAC-SHA is a better *Randomizer* than SHA. Why HMAC is better than say keyed SHA is clear.

Would you care to clarify this?

________________________________
From: [e-mail] <[e-mail]>
To: Zooko Wilcox-O'Hearn <[e-mail]>
Cc: [e-mail] <[e-mail]>
Sent: Thu Oct 22 19:09:32 2009
Subject: Re: [Cfrg] Answers to HKDF questions



On Wed, Oct 21, 2009 at 11:01 PM, Zooko Wilcox-O'Hearn <[e-mail]<mailto:[e-mail]>> wrote:
Dear Hugo Krawcyck:

Thank you for the detailed answers.  I still have a question about HMAC as compared to other MACs.  Feel free to point me to existing documents if they answer my question.  Suppose I were to instantiate HKDF with the keyed PRF being a cipher based MAC such as Poly1305 instead of HMAC.  Which of the arguments for HKDF's security would still apply?


To answer these questions I need to ask you some questions myself:

Can you explain how do you plan to use poly1305 for KDF.
Is it as an extractor, or for key expansion or both? You say as a "keyed PRF": how do you get a PRF out of your MAC and where does the key to the PRF come from?
Are you going to use only the universal hash part of poly1305 or the whole construction?
If the latter, where does the key for AES come from?

In general a MAC function does not imply a good KDF. Even a good PRF does not.
(If that was the case it would have been much easier to argue that HMAC is a good basis for KDF).

If you give me more details on what you mean by your "MAC-based KDF" I can try to answer more specifically.

Hugo