Re: [perpass] relevant LISP discussion

[Stephen Kent <[e-mail]>]

Nick,

> On 21/08/13 18:01, Stephen Kent wrote:
>> I might be more impressed if the sender of the message understood that
>> one does not use
>> EC(DH) to encrypt/decrypt anything!
> Thanks for the input. I am cryptographically naive, yes. The intention
> here isn't to impress anyone; but to hammer out something that might
> actually work in the real world.
>
> So the contention is that sha256( ecdh( public, private ) ) is not an
> appropriate to use as the secret key for a symmetric block cipher like
> aes256... in general? Only for long-lived keys? What happens if peers
> change those keys daily, or every T/G/MB?
My comment is that DH (EC or otheriwse) is a key agreement alg, and thus
does not encrypt/decrypt anything. It generates a shared, secret bit 
string that
can be processed to yield a key for a symmetric encryption or integrity 
alg.
A function used to generate such keys is called a KDF (key derivation 
function).
A symmetric alg with with such a key is used might or might not be a block
cipher. If one wants to generate a different (symmetric) encryption key
frequently, changing a DH key bound to an entity via a repository is not
a viable approach. Instead, one uses a random value as an additional 
input to the
KDF (a value sometimes referred to as a UKM, e.g., in the CMS spec).

Steve