[Cfrg] Fwd: Hash-Based Key Derivation

Tom Shrimpton writes:
>The problem is that all of our existing hash functions are based on the 
>Merkle-Damgard paradigm, but plain MD doesn't preserve random-oracle-ness.
>There's a nice new paper by Coron, Dodis, Malinaud and Puniya 
>"Merkle-Damgard Revisited: How to Construct a Hash Function" that addresses 
>this issue.

Amusingly, I view that paper as supporting the random oracle model,
not undermining it.  That paper provided evidence that it may be
reasonable to model our hash functions as random oracles, as long as
the hash functions are only invoked on some prefix-free message space.
More precisely, if the compression function is modeled as a random oracle,
then the MD scheme is also a random oracle as long as you ensure there is
no pair of possible messages M,M' in the message space such that M is a
prefix of M'.  And good cryptosystem designers already ought to know to
avoid length-extension attacks on MD hashes by ensuring that the message
space is chosen to be prefix-free.

I guess what I'm saying is that good cryptographic design involves
both provable security (e.g., in the random oracle model) as well as
application of good cryptographic hygiene, prudent engineering practices,
and other heuristic rules of thumb.  This combination seems to lead to
pretty reasonable protocols.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg