Re: [Hipsec] Major change to KEYMAT

[Miika Komu <[e-mail]>]

Robert Moskowitz wrote:

Hi,

> I am leaning heavily to change the KEYMAT process to using 
> http://www.ietf.org/id/draft-krawczyk-hkdf-00.txt

+1 assuming that this is going to adopted as a network WG official draft?

> The HITs will be the INFO fed into the Expand step, but there is a 
> deficiency in the current KEYMAT WRT the SALT for the Extract phase.
> 
> Currently we have I and J used in KEYMAT, but both J is not truly 
> sourced from the Initiator, it is influenced by I from the Responder.  
> And both are too short by 'accept practices' that each NONCE is twice 
> the size of the desired master key.
> 
> So there should be a NONCE1 in R1 and NONCE2 in I2.  I think that NONCE1 
> SHOULD be echoed back in I2.

There's already echo parameters in the base exchange, so they should be 
just mandatory.

> The NONCE length is variable, 256, 384, or 512 depending on the key size 
> needed?  Which raises the question of where we control key length for 
> AES?  We are probably defaulting to 128 and not allowing for larger key 
> lengths?

What about fixing the key sizes in the transform suite id definitions 
and providing new definitions with larger sizes when needed?