[tcpm] Question on crypto algo usage for TCP-AO

[Muthu Arul Mozhi Perumal <[e-mail]>]

Hi,

Section 3.1.1 of RFC 5926 describes how to derive the traffic key of
desired length to be used for the MAC calculation, especially when the
KDF_alg produces fewer bits than the key length required for the MAC_alg.

<snip>

   The output of multiple PRF invocations is simply concatenated.  For

   the Traffic_Key, values of multiple PRF invocations are concatenated

   and truncated as needed to create a Traffic_Key of the desired

   length.  For instance, if one were using KDF_HMAC_SHA1, which uses a

   160-bit internal PRF to generate 320 bits of data, one would execute

   the PRF twice, once with i=1 and once with i=2.  The result would be

   the entire output of the first invocation concatenated with the

   second invocation.  For example,

  Traffic_Key =

          KDF_alg(Master_Key, 1 || Label || Context || Output_length) ||

          KDF_alg(Master_Key, 2 || Label || Context || Output_length)

   If the number of bits required is not an exact multiple of the output

   size of the PRF, then the output of the final invocation of the PRF

   is truncated as necessary.

</snip>

The question I have is, what if the first invocation of the above PRF
itself produces more bits than the key length required by the MAC
calculation. Should the output of the first invocation be truncated? For
e.g. if one were to use AES-128-CMAC-96 as the MAC_alg and KDF_HMAC_SHA1 as
the KDF_alg, should the output of the foll. be truncated to 128 bits (since
it would produce a 160 bit output whereas AES-128-CMAC requires a 128-bit
key)?
KDF_alg(Master_Key, 1 || Label || Context || Output_length)

Regards,
Muthu