Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 11:10:39 -0700

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Monday, September 27, 2004 10:25 AM
> To: Paul Leach
> Cc: Liqiang(Larry) Zhu; Jeffrey Altman; [email-masked]; Sam
Hartman;
> Ken Raeburn
> Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF
> 
> >
> > [Paul Leach] Whereas I'm curious why the PRF for AES _isn't_ an
HMAC.
> 
> Well, yeah, me too.  The reason may have to do with kcrypto being a
> profile that all existing enctypes could fit, including des-cbc-crc.
> 

[Paul Leach] Considering that the PRF uses SHA1, everything necessary to
define it to be HMAC-SHA1 exists. There was no reason to involve the
encryption function at all.

Reminder: the PRF is defined as
	t = SHA1(opaque-string)
	output = E(k, t, zero-IV)

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 13:11:35 -0500

> encryption function at all.

Of course.  I was speculating that an HMAC-based PRF might not be
feasible for one existing krb5 enctype (is that so?), thus the original
impetus for the current kcrypto PRF construction.  Ken?

Nico
--

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 27 Sep 2004 14:20:25 -0400

> impetus for the current kcrypto PRF construction.  Ken?

I don't remember how we came up with the one for the simplified profile.
Sam, do you remember?

ken