Re: Consensus call was Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

>>>>> "Jeffrey" == Jeffrey Altman <jaltman@columbia.edu> writes:

    Jeffrey> Actually, the question I raised was on the krb5 prf draft
    Jeffrey> since that is where the current text is located.  I would
    Jeffrey> like a consensus call on the following questions.

    Jeffrey> (1) Add this text to the security considerations section
    Jeffrey> of the general prf draft:

    Jeffrey> Pseudorandom functions by their nature are capable of
    Jeffrey> producing only limited amounts of cryptographically
    Jeffrey> secure output. The exact amount of output that one can
    Jeffrey> safely use, unfortunately varies from one PRF to another
    Jeffrey> (which prevents us from recommending specific
    Jeffrey> numbers). Because of this, we recommend that unless you
    Jeffrey> really know what you are doing (i.e. you are a
    Jeffrey> cryptographer and are qualified to pass judgement on
    Jeffrey> cryptographic functions in areas of period, presence of
    Jeffrey> short cycles, etc), you limit the amount of the PRF
    Jeffrey> output used to the necessary minimum.

I'm willing to live with this text although it's not great.  I don't
have improvements to offer.  The spirit behind the text is fine.

_______________________________________________
Kitten mailing list
Kitten@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten