Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

>>>>> "Nicolas" == Nicolas Williams <Nicolas.Williams@sun.com> writes:

    Nicolas> On Thu, May 19, 2005 at 01:58:18PM -0400, Blumenthal, Uri
    Nicolas> wrote:
    >> >>> That text does need some cleanup, and the real issue is
    >> that the GSS-API >>> can't enforce any limits on the useful
    >> lifetime of PRF output used for >>> cryptographic purposes.
    >> So, I propose replacing that paragraph with:
    >> >>>
    >> >>> Care should be taken not to exceed the useful lifetime of
    >> >>> GSS_Pseudo_random() output, particularly when used for
    >> cryptographic >>> purposes.  Specifically, applications should
    >> limit use of >>> cryptographic keys derived from
    >> GSS_Pseudo_random() output to the >>> original lifetime of the
    >> security contexts to which >>> GSS_Pseudo_random() is applied.
    >> >>>
    >> >>> That seems much more specific -- no handfuls, pinches or
    >> touches.
    >> >>
    >> >> I am much happier with the proposed text.  Does anyone else
    >> have any >> comments?
    >> >
    >> >I have no problem with adding that text, but it sounds like it
    >> addresses a >different problem than the paragraph Nico proposes
    >> to replace.  The >existing text appears to be concerned about
    >> the amount of data which the >PRF can safely be used to
    >> generate.
    >> 
    >> I like the above text (let it stay), but agree with Jeff - we
    >> need something else in addition. Could say something along the
    >> lines of:
    >> 
    >> Care should be taken not to exceed the amount of data that PRF
    >> can safely generate.
    >> 
    >> This amount naturally depends on the mechanisms used. :-)

    Nicolas> This is a consideration for mechanisms as much as for
    Nicolas> applications.

    Nicolas> Mechanisms should not allow the PRF to output more than
    Nicolas> is safe.

I'm not sure that this is true.  I think it is a system level concern
and like Uri's original text.

_______________________________________________
Kitten mailing list
Kitten@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten