Re: deriving keying material from the shared secret

[Bill Sommerfeld <[e-mail]>]

All transforms which provide authentication and encryption need to
resist a known-plaintext key-recovery attack.

Using the strongest cryptographic part of the transform itself with
the shared secret as the *key* and some known plaintext as input might
be a good way to generate one or more keys for use by a given
transform.  If you need multiple keys, use multiple different known
plaintexts.

In the event the transform can't deal with a variable-length key, do
some not-necessarily-cryptographic transform of the shared secret to
come up with the fixed-length key (like the kerberos string-to-key
bitwise-fanfold-and-xor approach).

Upside: the resulting key generation should be no weaker than the
transform itself is, assuming the shared secret is big enough.  

For instance, for 3DES, you wouldn't weaken a 168-bit 3DES key to 160
or 128 bits by funnelling the key material through SHA or MD5.

Downside: you probably don't want to do this for algorithms where key
recovery might become practical (e.g., single-DES) because you'll leak
bits out of the shared secret that way.

					- Bill