Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 27 Sep 2004 10:11:50 -0700

Nicolas Williams  wrote:
> the kcrypto I-D.
 
humm... I am arguing for the recall of the kcrypto I-D.

________________________________

From: Nicolas Williams [mailto:[email-masked]]
Sent: Mon 9/27/2004 10:07 AM
To: Liqiang(Larry) Zhu
Cc: Ken Raeburn; Paul Leach; [email-masked]
Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF

On Mon, Sep 27, 2004 at 10:03:32AM -0700, Liqiang(Larry) Zhu wrote:
> Nicolas Williams:
>
> > so you don't avoid any complications
> > that way, plus we'd have to recall the AES I-D to do it.
>
> I do not see why we need to recall the AES I-D, can you explain?

Sorry, the kcrypto I-D.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 12:18:29 -0500

> humm... I am arguing for the recall of the kcrypto I-D.

And you're not responding to my responses to your arguments.

So far you're failing to convince me that:

a) the kcrypto PRF construction is somehow not cryptographically strong
(though it would be nice if kcrypto stated that its PRF construction is
intended to be strong [for strong enctypes]);

b) that we should recall the kcrypto I-D to add such verbiage;

c) or that we should change the kcrypto PRF construction to output as
many bits as are in the input key.

Nico
--