Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 27 Sep 2004 10:28:55 -0700

Nicolas Williams  wrote:
> You cannot avoid the need for a PRF+ somewhere.

I disagree, the PRF+ in IKEv2 and PEAP deals with the fact the output of PRF is not long enough.
 
if our PRF output is long enough for constructing keys with suitable attack resistance strength(that is exactly what I proposed for our PRF to do), what is the need of PRF+?
 
--Larry

________________________________

From: Nicolas Williams [mailto:[email-masked]]
Sent: Mon 9/27/2004 10:24 AM
To: Liqiang(Larry) Zhu
Cc: Ken Raeburn; Paul Leach; [email-masked]
Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF

On Mon, Sep 27, 2004 at 10:20:45AM -0700, Liqiang(Larry) Zhu wrote:
> Nicolas Williams wrote:
> >  The PRF API we'll be adding to the GSS-API, for
> > example, produces output that cannot then be fed to the GSS-API for use
> > as any sort of key for any mechanism -- that PRF is meant for use by
> > other applications, such as EAP mechanisms.
> 
> so you just reiterated that this PRF is intended for key-generation, right? it would be silly to claim the output is suitiable for key-genration, but the applicaiton need to invoke it multiple times with unknown construction/composition methods that are completely unspecified. Therefore I maintain the PRF description today fails to do the job it is supposed to do.

Re-read the above paragraph.

One enctype's PRF could be used to generate keys for any other cipher in
any other cryptosystem.  You will have key-size impedance mismatches.
You will need a PRF+.  You cannot avoid the need for a PRF+ somewhere.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 12:33:49 -0500

> if our PRF output is long enough for constructing keys with suitable attack resistance strength(that is exactly what I proposed for our PRF to do), what is the need of PRF+?

Larry, you're not reading my replies.

Nico
--