Subject: CONSENSUS CALL: PRF

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 10 Aug 2004 16:38:32 -0400

It seems my last message on this topic got lost, so I'll try again...

A couple of weeks ago, Sam proposed a change to the PRF defined in the 
kcrypto document, to avoid using a raw protocol key to derive pseudo-random 
values.  Instead, he proposes using a usage-specific key, as done elsewhere 
in the document.

This is a one-line change in the document, but it is still a change.
The PRF is not used by Kerberos, but will be used by other documents
being defined in this WG, including hardware-preauth and pkinit.

This document has been approved by the IESG and is in the RFC-Editor queue, 
which makes a change more difficult but not impossible.  Some people felt 
this was important enough to warrant a change, so I brought the issue up 
with Russ.  He indicated that given a working group concensus, he would 
allow this change to go through during the author's 48-hour review period 
prior to publication.

So I'm asking folks to indicate support for or opposition to this change.
The complete change is described in Sam's original message dated 
26-Jun-2004, with the exception of a specific value for the "prfconstant" 
used there.  I assume he'll propose such a value shortly.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 10 Aug 2004 18:05:21 -0400

> used there.  I assume he'll propose such a value shortly.

People keep pointing out problems with my messages.
Maybe I should just give up. :-)

Of course, Sam's message from two weeks ago was dated 26 July, not 26 June.

-- Jeff

---

From: "Paul B. Hill" <[email-masked]>
Date: Tue, 10 Aug 2004 18:14:13 -0400

Assuming that nobody comes forward in the next few hours to say that they
have already implemented and deployed the current PRF and that the revision
would break a deployment, I am in favor of the revision. 

Paul

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey
Hutzelman
Sent: Tuesday, August 10, 2004 6:05 PM
To: [email-masked]
Subject: Re: CONSENSUS CALL: PRF

-- Jeff

---

From: Clifford Neuman <[email-masked]>
Date: Wed, 11 Aug 2004 14:37:32 -0700

Members of the Kerberos working group,

ietf-krb-wg-kerberos-clarifications-07.txt has been subitted.  The
submission may be found by following the clarifications links from 

   http://kerberos.info.

Clifford Neuman

---

From: Wyllys Ingersoll <[email-masked]>
Date: Fri, 13 Aug 2004 10:20:44 -0400

Cliff -
    Is this the version that was supposed to have the minor edits included?

Section 8.1, page 111 still doesn't mention AES128 as a RECOMMENDED enctype,
I thought there was agreement that it would be added this time?

-Wyllys Ingersoll

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 13 Aug 2004 10:56:46 -0400

On Friday, August 13, 2004 10:20:44 -0400 Wyllys Ingersoll 
<[email-masked]> wrote:

> Section 8.1, page 111 still doesn't mention AES128 as a RECOMMENDED
> enctype, I thought there was agreement that it would be added this time?

If you look carefully, the document was changed, but there is a typo in the 
change.

AES256-CTS-HMAC-SHA1-96 was added to the RECOMMENDED enctype list.
Clearly the intent was to add AES128-CTS-HMAC-SHA1-96.

On a related note, if we RECOMMEND the AES128-CTS-HMAC-SHA1-96 enctype, we 
should also RECOMMEND the HMAC-SHA1-96-AES128 cksumtype.

-- Jeff

---

From: Clifford Neuman <[email-masked]>
Date: Fri, 13 Aug 2004 08:24:36 -0700 (PDT)

Oops.  Thanks for catching this.  You will notice

  AES256-CTS-HMAC-SHA1-96

under both MUST, and SHOULD.  The intent was that the second one was
supposed to be 128, and I did the cut and paste and didn't change the
number.  

Jeff,  what is the best way to fix this.  Submit an 08 with this one
change?

Cliff

   Date: Fri, 13 Aug 2004 10:20:44 -0400
   From: Wyllys Ingersoll <[email-masked]>

   Cliff -

   -Wyllys Ingersoll

---

From: Wyllys Ingersoll <[email-masked]>
Date: Fri, 13 Aug 2004 11:32:39 -0400

>supposed to be 128, and I did the cut and paste and didn't change the
I noticed it in both sections, but wasn't sure if it was included in the 
SHOULD
part for completeness or if it was a typo.

thanks,
  Wyllys

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 30 Aug 2004 17:14:38 -0400

Jeffrey Hutzelman <[email-masked]> writes:
> 26-Jun-2004, with the exception of a specific value for the
> "prfconstant" used there.  I assume he'll propose such a value shortly.

I'd like to indicate my support for the change, and I'll propose the
string "prf".  I've run a quick check, and for several output lengths,
n-fold of "prf" does not collide with the n-fold output of "kerberos"
(used in 3des string-to-key) or the values used by the simplified
profile for the first 160K key usage values.

Ken