IETF Logo Mail Archive

Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

"D. J. Bernstein" <djb@cr.yp.to> Fri, 28 October 2005 10:40 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EVRef-0008Lh-Tp; Fri, 28 Oct 2005 06:40:13 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EVRed-0008HA-5B for cfrg@megatron.ietf.org; Fri, 28 Oct 2005 06:40:11 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA06687 for <cfrg@ietf.org>; Fri, 28 Oct 2005 06:39:54 -0400 (EDT)
Received: from stoneport.math.uic.edu ([131.193.178.160]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1EVRsA-000177-JN for cfrg@ietf.org; Fri, 28 Oct 2005 06:54:11 -0400
Received: (qmail 64523 invoked by uid 1016); 28 Oct 2005 10:40:32 -0000
Date: Fri, 28 Oct 2005 10:40:31 -0000
Message-ID: <20051028104031.64522.qmail@cr.yp.to>
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.
From: "D. J. Bernstein" <djb@cr.yp.to>
To: cfrg@ietf.org
Subject: Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)
References: <Pine.GSO.4.44_heb2.09.0510270108410.9033-100000@ee.technion.ac.il>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
X-Spam-Score: 0.0 (/)
X-Scan-Signature: de4f315c9369b71d7dd5909b42224370
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

Hugo Krawczyk writes:
> First  step:  K=H(SV || [context-information1])
> Second step:  Hi=PRF(K, counter++ || [context-information2]

How do we build PRFs? By hashing the key and the input. So this
construction boils down to something like H(H(SV,context),counter++). Or
maybe you want H(H(H(SV,context),counter++),H(SV,context)) because you
don't really trust your H. Or perhaps you meant

   H(SV,H(counter++,H(H(H(SV,context),counter++),H(SV,context))))

because security is really measured by the number of H's, right? Whoops,
looks like the added implementation difficulty made me double-increment
the counter, which I'll have to fix; nobody said security was easy!

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email