IETF Logo Mail Archive

Re: KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]

"D. J. Bernstein" <djb@cr.yp.to> Sat, 29 October 2005 10:33 UTC

Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EVo1v-00013p-Mr; Sat, 29 Oct 2005 06:33:43 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EVo1u-00013h-KZ for cfrg@megatron.ietf.org; Sat, 29 Oct 2005 06:33:42 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA23418 for <cfrg@ietf.org>; Sat, 29 Oct 2005 06:33:25 -0400 (EDT)
Received: from stoneport.math.uic.edu ([131.193.178.160]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1EVoFe-0007Ld-MB for cfrg@ietf.org; Sat, 29 Oct 2005 06:47:55 -0400
Received: (qmail 39941 invoked by uid 1016); 29 Oct 2005 10:34:03 -0000
Date: Sat, 29 Oct 2005 10:34:03 -0000
Message-ID: <20051029103403.39940.qmail@cr.yp.to>
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.
From: "D. J. Bernstein" <djb@cr.yp.to>
To: cfrg@ietf.org
Subject: Re: KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]
References: <200510282204.j9SM43mw013898@taverner.CS.Berkeley.EDU>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

David Wagner writes:
> > > The hash function also has to be independent of the adversary's choices.
> > No, that sort of assumption is always wrong for public hash functions.
> Exactly my point. I'm saying the assumption is necessary for provable
> security under the Leftover Hash Lemma

No. Your false hypothesis is not an assumption of the lemma. You clearly
understand that the lemma applies to public hash functions used for one
message; I have no idea why you think that the multiple-message case is
different. Anyway, I already cited a Shoup page that explains all this
in detail.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email