[Cfrg] Re: Comments on SIV and draft-dharkins-siv-aes-00

  Hi David,

  I think my response to your key derivation comment was wrong.

On Thu, October 18, 2007 1:41 pm, mcgrew wrote:
[snip]
> For the key derivation application (Section 1.3.3), what would the SIV
> plaintext input be equal to?  Would it be omitted?
>
> Also, I would guess that SIV-based key derivation would only be
> appropriate
> for deriving keys from a given key, and that it may not be suitable for
> use
> in deriving keys from data that is unpredictable but not uniformly random,
> as is used e.g. in Diffie-Hellman.  At least, I believe that this is
> outside
> of the scope of what is claimed in the security analysis, and it would
> make
> sense to document that (after verifying with Phil and Tom).

  As I mentioned, there is no plaintext since it S2V that's doing the
key derivation but I let that cause me to misinterpret your subsequent
comment. S2V requires a key and if that key is not uniformly random I do
believe that it would be inappropriate to use.

  I'll verify with Phil and Tom and most likely come up with some text
to address this.

  Sorry for the brush off. I read one comment and let that cloud my
response to another.

  Dan.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg