Subject: KRB-WG Interim Meeting Tommorrow

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 30 Sep 2002 08:52:49 -0500

For those of you who will not be attending the interim meeting 
at MIT Oct 1 and 2, if you have comments on the Clarifications
please send your comments to the mail list. 

See:
http://www.kerberos.isi.edu/

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 30 Sep 2002 17:24:15 +0200

> please send your comments to the mail list. 

I have some on draft-ietf-krb-wg-crypto-01.txt.  I hope that draft is
part of Clarifications, if not please ignore this.

Quoting 5.2:

,----
...
|    0x00000000000000F0.  This key is then used to generate a DES CBC
|    checksum on the initial string with the salt appended.  The result of
|    the CBC checksum is the "corrected" as described above to form the
|    result which is returned as the key.
...
|             key = key_correction(DES-CBC-check(s,tempkey));
...
`----

The terms "CBC checksum" and "DES-CBC-check" are a bit loose.  There
are maybe more than 10 ways to implement a MAC based on DES and CBC.
It is made even more confusing when the draft specifies another
(incompatible) DES-CBC-MAC algorithm further down in section 6.3.

bash-2.05b$ diff -u orig draft-ietf-krb-wg-crypto-01.txt
--- orig	2002-08-16 18:57:38.000000000 +0200
+++ draft-ietf-krb-wg-crypto-01.txt	2002-08-16 18:59:33.000000000 +0200
@@ -938,6 +938,10 @@
    the CBC checksum is the "corrected" as described above to form the
    result which is returned as the key.
 
+   For purposes of the string-to-key function, the DES CBC checksum is
+   calculated by CBC encrypting a string using the key as IV and using
+   the final 8 byte block as the checksum.
+
    Pseudocode follows:
 
         key_correction(key) {

Some more nitpicking.

--- draft-ietf-krb-wg-crypto-01.txt.1	2002-05-06 19:12:51.000000000 +0200
+++ draft-ietf-krb-wg-crypto-01.txt	2002-08-26 21:35:09.000000000 +0200
@@ -878,12 +878,12 @@
    additional input in the form of an initialization vector; this vector
    is specified for each encryption system, below.
 
-   The DES specifications identify some 'weak' and 'semi-weak' keys;
-   those keys shall not be used for encrypting messages for use in
-   Kerberos.  Additionally, because of the way that keys are derived for
-   the encryption of checksums, keys shall not be used that yield 'weak'
-   or 'semi-weak' keys when eXclusive-ORed with the hexadecimal constant
-   0xF0F0F0F0F0F0F0F0.
+   The DES specifications [DESI81] identify four 'weak' and twelve
+   'semi-weak' keys; those keys shall not be used for encrypting
+   messages for use in Kerberos.  Additionally, because of the way
+   that keys are derived for the encryption of checksums, keys shall
+   not be used that yield 'weak' or 'semi-weak' keys when
+   eXclusive-ORed with the hexadecimal constant 0xF0F0F0F0F0F0F0F0.
 
    A DES key is 8 octets of data.  This consists of 56 bits of actual
    key data, and 8 parity bits, one per octet.  The key is encoded as a
@@ -1776,6 +1776,11 @@
    particular attack.  However, most Kerberos implementations still have
    DES as their primary interoperable encryption type.
 
+   DES has four 'weak' keys and twelve 'semi-weak' keys, and the use
+   of single-DES here avoids them. However, DES also has 48
+   'possibly-weak' keys [Schneier96] (note that the tables in many
+   editions of the reference contains errors) which are not avoided.
+
    DES has a small number of "weak" and "semiweak" keys, but the use of
    triple-DES makes no effort to avoid them.  The nature of the weak
    keys is such that it is extremely unlikely that they will weaken the
@@ -2386,6 +2391,11 @@
       National Bureau of Standards, U.S. Department of Commerce, "Data
       Encryption Standard," Federal Information Processing Standards
       Publication 46, Washington, DC, 1977.
+   [DESI81]
+      National Bureau of Standards, U.S. Department of Commerce,
+      "Guidelines for implementing and using NBS Data Encryption
+      Standard," Federal Information Processing Standards Publication
+      74, Washington, DC, 1981.
    [DESM80]
       National Bureau of Standards, U.S. Department of Commerce, "DES
       Modes of Operation," Federal Information Processing Standards
@@ -2446,6 +2456,9 @@
    [Kerb1510]
       Kohl, J., and C. Neuman, "The Kerberos Network Authentication
       Service (V5)", RFC 1510, September 1993.
+   [Schneier96]
+      Schneier, B., "Applied Cryptography Second Edition", John Wiley
+      & Sons, New York, NY, 1996.  ISBN 0-471- 12845-7.
 
Typo in test vectors? 
 
--- draft-ietf-krb-wg-crypto-01.txt.orig	2002-05-06 19:12:51.000000000 +0200
+++ draft-ietf-krb-wg-crypto-01.txt	2002-09-30 17:19:00.000000000 +0200
@@ -2000,7 +2005,7 @@
    salt:        "ATHENA.MIT.EDUJuri" + s-caron + "i" + c-acute
                           415448454e412e4d49542e4544554a757269c5a169c487
    password:    eszett    c39f
-   fan-fold result:       b8f6c40e305afc9e
+   fan-fold result:       b8f6c40e305afc9f
    intermediate key:      b9f7c40e315bfd9e
    DES key:               62c81a5232b5e69d