Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 11:36:08 -0700

> -----Original Message-----
> From: Ken Raeburn [mailto:[email-masked]]
> Sent: Monday, September 27, 2004 11:17 AM
> To: Nicolas Williams
> Cc: Ken Raeburn; Paul Leach; Liqiang(Larry) Zhu; [email-masked]
> Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF
> 
> On Sep 27, 2004, at 14:09, Nicolas Williams wrote:
> > I was nitpicking one of Larry's comments; I was saying that we need
not
> > worry, in the PRF+ construction, about collisions in the PRF,
provided
> > that the PRF is strong because such collisions would have to be rare
> > and
> > unpredictable and would not affect the strength of the PRF+.
> 
> I think Larry's point was that he wanted some assurance that the
> probability would be extremely low, and he didn't think he was getting
> it from the specification...
[Paul Leach] That's my understanding, too. Isn't such a clarification
something that can be inserted by the RFC editor, w/o recycling?

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 16:46:42 -0400

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    >> -----Original Message----- From: Ken Raeburn
    >> [mailto:[email-masked]] Sent: Monday, September 27, 2004 11:17
    >> AM To: Nicolas Williams Cc: Ken Raeburn; Paul Leach;
    >> Liqiang(Larry) Zhu; [email-masked] Subject: Re: Concern:
    >> Does kcrypto imply that PRF is really a PRF
    >> 
    Paul> not
    >> > worry, in the PRF+ construction, about collisions in the PRF,
    Paul> provided
    >> > that the PRF is strong because such collisions would have to
    >> be rare > and > unpredictable and would not affect the strength
    >> of the PRF+.
    >> 
    >> I think Larry's point was that he wanted some assurance that
    >> the probability would be extremely low, and he didn't think he
    >> was getting it from the specification...
    Paul> [Paul Leach] That's my understanding, too. Isn't such a
    Paul> clarification something that can be inserted by the RFC
    Paul> editor, w/o recycling?

No, I don't think so.  I think that if we are all agreed that we
intend the PRF in kcrypto to be a PRF that we're probably OK waiting
for the standard to advance to draft to clarify.

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 16:57:58 -0400

>>>>> "Sam" == Sam Hartman <[email-masked]> writes:

    >>> [mailto:[email-masked]] Sent: Monday, September 27, 2004
    >>> 11:17 AM To: Nicolas Williams Cc: Ken Raeburn; Paul Leach;
    Paul> not
    Paul> provided
    >>> be rare > and > unpredictable and would not affect the
    >>> strength of the PRF+.
    >>> 

    Sam> No, I don't think so.  I think that if we are all agreed that
    Sam> we intend the PRF in kcrypto to be a PRF that we're probably
    Sam> OK waiting for the standard to advance to draft to clarify.

There should have been a paragraph break in there.  I.E. I don't think
this change is one we can make without IESG review.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 27 Sep 2004 17:11:56 -0400

> for the standard to advance to draft to clarify.

I've stated in another message that I believe we can insert such a 
clarification.  The real answer will have to come from the AD; I will ask 
if the WG comes to the conclusion that this is what it wants to do.

On the other hand, I also agree with Sam that from a practial standpoint, 
if the PRF defined for the simplified profile meets the requirement, then 
we can probably wait to express the requirement until we advance to draft, 
since it is unlikely that any new enctypes will be defined before then 
which (a) do not use the simplified profile, (b) are written by people not 
familiar with the situation, and (c) do not undergo at least some form of 
review (even if informal) by members of this WG.

-- Jeff