Re: [tcpm] handling variable length keys in draft-lebovitz-ietf-tcpm-tcp-ao-crypto

[Eric Rescorla <[e-mail]>]

At Sun, 26 Jul 2009 11:40:50 -0400,
Polk, William T. wrote:
> 
> Gregory,
> 
> As requested, Pasi and I took a look at how draft-lebovitz-ietf-tcpm-tcp-ao-crypto
> handles the AES-CMAC case when the master key is not 128 bits.
> 
> The method currently used (using AES-CMAC with a known fixed key as a
> "randomness extractor") is basically the same as used in IKEv2 (RFC
> 4615 and 4434), except IKEv2 uses all-zeroes key (but the specific
> value of the known fixed key shouldn't matter much -- just pick one).
> 
> Using the same method in TCP-AO would be acceptable us, and seems
> strongly preferable to requiring network admins to configure exactly
> 128 bit keys.
> 
> Other methods of getting from "what the admin configures" to 128 bits
> could work, too. Since the output of this step is *only* used as the
> key for further PRF calculations (and for *nothing* else), the
> requirements for it are very limited. If all keys were <= 128 bits,
> even something trivial such as padding with zeroes would work -- so
> this step doesn't even have to be one-way.

It seems like you're putting a lot of weight on AES to assume that
a key that is 24 random bits and 104 bits of zeros at the end
really has strength 2^24

-Ekr