Re: [kitten] WGLC on draft-ietf-kitten-aes-cts-hmac-sha2-06

[Nico Williams <[e-mail]>]

On Thu, Apr 02, 2015 at 12:20:05PM -0400, Greg Hudson wrote:
> * For the 192-bit security level, why use SHA-384 and truncate to 192
> bits?  Why not use SHA-256 and truncate to 192 bits?

I've no objection to the construction

    MAC(k, x) = trunc(HMAC(k,H), output_size(H)/2.

It's simple and obvious.

> * Why use a 192-bit HMAC key for Ki and Kc but not for Kp?

This I dont' understand.  The HMAC key should be the same size as the
cipher key.

I suspect this is an editing error.

There should be two or three enctypes:

 - aes128-cts-hmac-sha256-128

   AES with 128-bit keys, and
     MAC = trunc-128(HMAC-SHA256) with 128-bit HMAC keys

 - aes192-cts-hmac-sha384-192

   AES with 192-bit keys, and
     MAC = trunc-192(HMAC-SHA384) with 192-bit HMAC keys

 - aes256-cts-hmac-sha512-256

   AES with 256-bit keys, and
     MAC = trunc-256(HMAC-SHA512) with 256-bit HMAC keys

Generally, the security level of the components should match the overall
security level of the enctype.

I suppose an aes256-cts-hmac-sha384-192 would be OK, but only if we
reject AES-192 and such an enctype is noticeably faster than
aes256-cts-hmac-sha512-256.

> * Why use 128/256-bit PRF output lengths?  Why not just output the full
> hash?  It can't be for consistency with RFC 3962, as
> aes256-cts-hmac-sha1-96 has a 128-bit PRF output length.  It can't be
> out of some desire to consistently truncate SHA-2 results in half, or we
> would have 128/192-bit output lengths.

Eh?  The KDF is a truncation of the PRF.  The PRF is not truncated.

>From the draft:

   When the encryption type is aes128-cts-hmac-sha256-128, the output
   key length k is 128 bits for all applications of KDF-HMAC-SHA2(key,
   constant) which is computed as follows:

     K1 = HMAC-SHA-256(key, 00 00 00 01 | constant | 00 | 00 00 00 80)
     KDF-HMAC-SHA2(key, constant) = random-to-key(k-truncate(K1))
              ^^^^

The "SHA2" there must be a cut-n-paste error, otherwise it looks right
to me.

(RFC3962 does not define a PRF, just a KDF.)

Nico
--