Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 10:23:06 -0700

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Monday, September 27, 2004 10:07 AM
> To: Liqiang(Larry) Zhu; Jeffrey Altman; [email-masked]; Sam
Hartman;
> Paul Leach; Ken Raeburn
> Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF

> 
> I'm curious though, why does the AES enctype use an HMAC-based PRF for
> its string-to-key construction?  This is not the PRF defined in
> kcrypto...

[Paul Leach] Whereas I'm curious why the PRF for AES _isn't_ an HMAC.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 12:25:12 -0500

> [Paul Leach] Whereas I'm curious why the PRF for AES _isn't_ an HMAC.

Well, yeah, me too.  The reason may have to do with kcrypto being a
profile that all existing enctypes could fit, including des-cbc-crc.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 14:32:50 -0400

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    Paul> [Paul Leach] Whereas I'm curious why the PRF for AES _isn't_
    Paul> an HMAC.

Note that you don't really want a PRF for a string2key function.  The
requirements for string2key are somewhat different than requirements
for a PRF.  When I last looked at literature on the string2key problem
(aronud 2000), the requirements for a string2key function were not
even well understood.  The state of the art seemed to be throwing
things together with a lot of hashing and hoping something reasonable
came out.  

In particular, everything about a PRF depends on having a strong key
as one of the inputs.  Once you have that, you can get fairly simple
constructions especially if you are willing to assume that you have a
strong primitive like an ideal block cipher.

--Sam