Subject: Comments on draft-raeburn-krb-rijndaelkrb-03

From: [email-masked] (Sam Hartman)
Date: Thu, 3 Apr 2003 10:41:25 -0500 (EST)

I went through what I hope is one last review of the AES document.

In section 9, the following text has a comma just after a preposition:

    attack is through preauthentication mechanisms that provide better
    protection of, the user's long-term key.  Use of such mechanisms is
    out of scope for this document.

Also, in section 9:

    Also, generating a 256-bit key from a pass phrase of any length may
    be deceptive, since the effective entropy in pass-phrase-derived key
    cannot be nearly that large.

Is there some reason we do not mention the explicit limit of sha-1
(160 bits)?  Are we concerned there might be a slightly lower upper
limit because of the s2k function that we don't really know?

I did not confirm the accuracy of the test vectors although I did look
at whether sufficient test vectors were included to make
interoperability likely.

Having reviewed the document, I would like to recommend it for
publication.  I have not yet thought about Marcus's comments on AES
timing; it seems that at worst we would need to change the default
iteration count to address these comments.

---

From: Love <[email-masked]>
Date: Thu, 03 Apr 2003 17:59:40 +0200

> at whether sufficient test vectors were included to make

I've tested the vectors with the AES implemetation in Heimdal.

Love

---

From: Ken Raeburn <[email-masked]>
Date: Thu, 03 Apr 2003 17:08:15 -0500

>     out of scope for this document.

Noted, thanks.

> limit because of the s2k function that we don't really know?

I am not sufficiently familiar with analysis of such things to say how
that relates to the effective entropy of the final key.  Indeed, I
probably should've consulted someone who is before including that
statement.

I think it's entirely accurate to say that any pass phrase used by a
human is unlikely to present anywhere near 256 bits of randomness, but
I'm not convinced it's impossible, especially if the pass phrase is
long, machine generated and never used by a human.

If the second block of 160 bits (which gets truncated to 256-160=96
bits) were simply derived from the first, the result would be clear.
The actual derivation is something like:

  DK = T1 || T2<1..96>
  T1 = F (P, S, c, 1) = PRF(P, S || INT(1)) xor ...
  T2 = F (P, S, c, 2) = PRF(P, S || INT(2)) xor ...

How much does the one byte difference in the first PRF perturb the use
of the pass phrase data?  And recall that the output of the first PRF
is fed in as an input to the second, and its output into the third,
etc....

If the pass phrase P contains a very large amount of entropy, might
not the two PRF invocations with different parameters preserve between
them slightly more than one invocation?  If not, it seems to me that
the changing of 1 to 2 would then have somewhat predictable results,
which would be bad for a PRF.

Looking at it a slightly different way, if P is over 320 bits and
purely random, how many possibilities are there for T1 || T2, or even
the truncated form?

So, I'm not convinced the 160-bit limit of sha-1 necessarily applies
to pbkdf2.  But I couldn't assert that it does not, either.

Ken

---

From: Sam Hartman <[email-masked]>
Date: Thu, 03 Apr 2003 18:03:18 -0500

>>>>> "Ken" == Ken Raeburn <[email-masked]> writes:

    Ken> So, I'm not convinced the 160-bit limit of sha-1 necessarily
    Ken> applies to pbkdf2.  But I couldn't assert that it does not,
    Ken> either.

OK, I actually misunderstood pbkdf2 and withdraw my comment; your text
sounds reasonable based on the reality of the situation.