Re: [kitten] I-D Action: draft-ietf-kitten-aes-cts-hmac-sha2-05.txt

[Simo Sorce <[e-mail]>]

On Tue, 23 Sep 2014 05:25:46 -0700
[e-mail] wrote:

> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Common Authentication
> Technology Next Generation Working Group of the IETF.
> 
>         Title           : AES Encryption with HMAC-SHA2 for Kerberos 5
>         Authors         : Michael J. Jenkins
>                           Michael A. Peck
>                           Kelley W. Burgin
> 	Filename        : draft-ietf-kitten-aes-cts-hmac-sha2-05.txt

Hi while reading this otherwise very nice specification two questions
kept popping in my mind.

Why SHA-512 is not being used ?
Why AES-192 is not being used and SHA-384 is paired with AES-256
instead ?
Why are you using a hash twice the size of the bit strength required,
and chop it off, isn't HMAC supposedly not affected by birthday
attacks ?

I can guess at the rationale of some of these choices (some of it was
discussed in IETF meetings/lists), but it would be nice to have a
section that explains the choice or even just a reference to some other
document that does.

Regards,
Simo.

-- 
Simo Sorce * Red Hat, Inc * New York