RE: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

Darn... You start giving advices, and now they demand the actual text
from you! Next you know they'll ask for an implementation! :-)

How about:

Pseudorandom functions by their nature are capable of producing only
limited amount of cryptographically secure output. The exact amount of
output that one can safely use, unfortunately varies from one PRF to
another (which prevents us from recommending specific numbers). Because
of this, we recommend that unless you really know what you are doing
(i.e. you are a cryptographer and are qualified to pass judgement on
cryptographic functions in areas of period, presence of short cycles,
etc) - you limit the amount of the PRF output to the necessary minimum. 

Don't forget to edit my English! :-)

-----Original Message-----
From: Nicolas Williams [mailto:Nicolas.Williams@sun.com] 
Sent: Monday, May 23, 2005 5:16 PM
To: Blumenthal, Uri
Cc: Ken Raeburn; kitten@ietf.org
Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

On Mon, May 23, 2005 at 05:11:01PM -0400, Blumenthal, Uri wrote:
> IMHO if a PRF can handle only a dozen or so calls - it's so
> cryptographically weak that it doesn't belong anyway. It should
suffice
> for us to mention the reason why the user may want to limit the amount
> of PRF output.
> 
> I don't think a good PRF would leak any material except for when its
> period is reached (a good PRF won't have short cycles either).
> 
> So we can drop giving concrete numbers (after all, if we don't know
the
> underlying crypto - we can't tell how many bits the resulting PRF can
> safely output), but just say that because of <a>, <b> and <c> the user
> should take care and limit the number of PRF invocations/output bits.
> 
> Does this make sense?

Ok.  Text please?

_______________________________________________
Kitten mailing list
Kitten@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten