Re: [kitten] WGLC on draft-ietf-kitten-aes-cts-hmac-sha2-06

[Benjamin Kaduk <[e-mail]>]

On Wed, 15 Apr 2015, Nico Williams wrote:

> Eh?  The KDF is a truncation of the PRF.  The PRF is not truncated.
>
> From the draft:
>
>    When the encryption type is aes128-cts-hmac-sha256-128, the output
>    key length k is 128 bits for all applications of KDF-HMAC-SHA2(key,
>    constant) which is computed as follows:
>
>      K1 = HMAC-SHA-256(key, 00 00 00 01 | constant | 00 | 00 00 00 80)
>      KDF-HMAC-SHA2(key, constant) = random-to-key(k-truncate(K1))
>               ^^^^
>
> The "SHA2" there must be a cut-n-paste error, otherwise it looks right
> to me.

It is not a cut/paste error; they are defining KDF-HMAC-SHA2() one way for
the 128-bit case, and below KDF-HMAC-SHA2() is defined for the 256-bit
case.

Greg doesn't like this implicitness and requested an explicit length
parameter be used.

-Ben