[Hipsec] Something wrong in -12 Re: Fwd: New Version Notification for draft-ietf-hip-dex-12.txt

[Robert Moskowitz <[e-mail]>]

On 2/12/20 12:50 PM, Jeff Ahrenholz wrote:
>>> Looking at Section 6.3 HIP DEX KEYMAT Generation, it discusses
>>> using Diffie-Hellman derived key Kij, but I don't see anything
>>> about using I_NONCE. There is a random #I  provided by the
>>> Responder from the PUZZLE parameter, but nothing about a
>>> random I_NONCE supplied by the Initiator.
>>     
>>     In 6.3:
>>     
>>             IKM       Input keying material
>>                         the Diffie-Hellman derived key, concatenated with the
>>                           random I_NONCE value for the Master Key SA
>>                         the Diffie-Hellman derived key, concatenated with the
>>                           random values of the ENCRYPTED_KEY parameters in
>>                           the same order as the HITs with sort(HIT-I | HIT-R)
>>                           for the Pair-wise Key SA   The key derivation for the Master Key SA employs always both the
>>     Extract and Expand phases.  The Pair-wise Key SA needs only the
>>     Extract phase when key is smaller or equal to 128 bits, but otherwise
>>     requires also the Expand phase.
>>
>>     The CKDF-Extract function is the following operation:
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> Moskowitz, et al.        Expires August 15, 2020               [Page 32]
>> 
>> Internet-Draft           HIP Diet EXchange (DEX)           February 2020
>>
>>
>>       CKDF-Extract(I, IKM, info) -> PRK
>>
>>       Inputs:
>>         I         Random #I, provided by the Responder, from the PUZZLE
>>                   parameter
>>
>>         IKM       Input keying material
>>                     the Diffie-Hellman derived key, concatenated with the
>>                       random I_NONCE value for the Master Key SA
>>                     the Diffie-Hellman derived key, concatenated with the
>>                       random values of the ENCRYPTED_KEY parameters in
>>                       the same order as the HITs with sort(HIT-I | HIT-R)
>>                       for the Pair-wise Key SA
>>
>>         info      sort(HIT-I | HIT-R) | "CKDF-Extract"
>>                   where "CKDF-Extract" is an octet string
>>
>>       Output:
>>         PRK       a pseudorandom key (of RHASH_len/8 octets)
>>
>>
>>     The pseudorandom key PRK is calculated as follows:
>>
>>         PRK     = CMAC(I, IKM | info)
>>
>>     The CKDF-Expand function is the following operation:
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> Moskowitz, et al.        Expires August 15, 2020               [Page 33]
>> 
>> Internet-Draft           HIP Diet EXchange (DEX)           February 2020
>>
>>
>>       CKDF-Expand(PRK, info, L) -> OKM
>>
>>       Inputs:
>>         PRK       a pseudorandom key of at least RHASH_len/8 octets
>>                   (either the output from the extract step or the
>>                   concatenation of the random values of the
>>                   ENCRYPTED_KEY parameters in the same order as the
>>                   HITs with sort(HIT-I | HIT-R) in case of no extract)
>>         info      sort(HIT-I | HIT-R) | "CKDF-Expand"
>>                   where "CKDF-Expand" is an octet string
>>         L         length of output keying material in octets
>>                   (<= 255*RHASH_len/8)
>>
>>       Output:
>>         OKM        output keying material (of L octets)
>>
>>     The output keying material OKM is calculated as follows:
>>
>>         N       =  ceil(L/(RHASH_len/8))
>>         T       =  T(1) | T(2) | T(3) | ... | T(N)
>>         OKM     =  first L octets of T
>>
>>     where
>>
>>         T(0) = empty string (zero length)
>>         T(1) = CMAC(PRK, T(0) | info | 0x01)
>>         T(2) = CMAC(PRK, T(1) | info | 0x02)
>>         T(3) = CMAC(PRK, T(2) | info | 0x03)
>>         ...
>>
>      
> Is this a new table row, or maybe something happened to the output?

Look at it in the draft, it does not format so well in a message.


> It looks good.
>
> In the dex-12 html/text versions I'm seeing the following text, which does not list IKM or info inputs for CKDF-Extract:
>
>
>     The CKDF-Extract function is the following operation:
>
>       CKDF-Extract(I, IKM, info) -> PRK
>
>       Inputs:
>         I         Random #I, provided by the Responder, from the PUZZLE
>                   parameter
>
>     The CKDF-Expand function is the following operation:
>
>
>
>
> Moskowitz, et al.        Expires August 12, 2020               [Page 32]
>
>
> Internet-Draft           HIP Diet EXchange (DEX)           February 2020
>
>
>       CKDF-Expand(PRK, info, L) -> OKM
>
>       Inputs:
>         PRK       a pseudorandom key of at least RHASH_len/8 octets
>                   (either the output from the extract step or the
>                   concatenation of the random values of the
>                   ENCRYPTED_KEY parameters in the same order as the
>                   HITs with sort(HIT-I | HIT-R) in case of no extract)
>         info      sort(HIT-I | HIT-R) | "CKDF-Expand"
>                   where "CKDF-Expand" is an octet string
>         L         length of output keying material in octets
>                   (<= 255*RHASH_len/8)
>


Oh, oh.  I checked https://www.ietf.org/id/draft-ietf-hip-dex-12.txt and 
you are right and it is wrong.


Miika?  Something went wrong from what I sent and what got posted. Here 
is what I have from running xml2rfc locally on the xml:


=============================================

    The key derivation for the Master Key SA employs always both the
    Extract and Expand phases.  The Pair-wise Key SA needs only the
    Extract phase when key is smaller or equal to 128 bits, but otherwise
    requires also the Expand phase.

    The CKDF-Extract function is the following operation:












Moskowitz, et al.        Expires August 15, 2020               [Page 32]

Internet-Draft           HIP Diet EXchange (DEX)           February 2020


      CKDF-Extract(I, IKM, info) -> PRK

      Inputs:
        I         Random #I, provided by the Responder, from the PUZZLE
                  parameter

        IKM       Input keying material
                    the Diffie-Hellman derived key, concatenated with the
                      random I_NONCE value for the Master Key SA
                    the Diffie-Hellman derived key, concatenated with the
                      random values of the ENCRYPTED_KEY parameters in
                      the same order as the HITs with sort(HIT-I | HIT-R)
                      for the Pair-wise Key SA

        info      sort(HIT-I | HIT-R) | "CKDF-Extract"
                  where "CKDF-Extract" is an octet string

      Output:
        PRK       a pseudorandom key (of RHASH_len/8 octets)


    The pseudorandom key PRK is calculated as follows:

        PRK     = CMAC(I, IKM | info)

    The CKDF-Expand function is the following operation:

























Moskowitz, et al.        Expires August 15, 2020               [Page 33]

Internet-Draft           HIP Diet EXchange (DEX)           February 2020


      CKDF-Expand(PRK, info, L) -> OKM

      Inputs:
        PRK       a pseudorandom key of at least RHASH_len/8 octets
                  (either the output from the extract step or the
                  concatenation of the random values of the
                  ENCRYPTED_KEY parameters in the same order as the
                  HITs with sort(HIT-I | HIT-R) in case of no extract)
        info      sort(HIT-I | HIT-R) | "CKDF-Expand"
                  where "CKDF-Expand" is an octet string
        L         length of output keying material in octets
                  (<= 255*RHASH_len/8)

      Output:
        OKM        output keying material (of L octets)

    The output keying material OKM is calculated as follows:

        N       =  ceil(L/(RHASH_len/8))
        T       =  T(1) | T(2) | T(3) | ... | T(N)
        OKM     =  first L octets of T

    where

        T(0) = empty string (zero length)
        T(1) = CMAC(PRK, T(0) | info | 0x01)
        T(2) = CMAC(PRK, T(1) | info | 0x02)
        T(3) = CMAC(PRK, T(2) | info | 0x03)
        ...