Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 12:14:44 -0700

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]]
> Sent: Monday, September 27, 2004 12:01 PM
> To: Paul Leach
> Cc: Liqiang(Larry) Zhu; Jeffrey Altman; [email-masked]; Ken
Raeburn
> Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF
> 
> >>>>> "Paul" == Paul Leach <[email-masked]> writes:
> 
>     >> -----Original Message----- From: Sam Hartman
>     >> [mailto:[email-masked]] Sent: Monday, September 27, 2004
>     >> 11:28 AM To: Liqiang(Larry) Zhu Cc: Jeffrey Altman;
>     >> [email-masked]; Paul Leach; Ken Raeburn Subject: Re:
>     >> Concern: Does kcrypto imply that PRF is really a PRF
> 
> 
>     >> All you have shown is that the PRF uses at most 160-bits of
>     >> entropy from the functional input.  Put another way, you should
>     >> not call this PRF more than 2**80 times with a given key.  That
>     >> seems acceptable to me; if you believe it is not acceptable you
>     >> should have brought it up during the last call of either AES or
>     >> kcrypto.
>     Paul> [Paul Leach] That seems clearly unacceptable -- it means
>     Paul> that Kerberos in AES mode with 256 bit keys can
>     Paul> intrinsically never get true 256 bit strength.
> 
> How does it mean that?
> 
> Keep in mind that 160 bits of SHA1 is greater than 128-bits of AES
> output.
[Paul Leach] Are you saying that AES keys bigger that 128 bits offer no
additional strength because the block size of AES is 128 bits?

If not, then limiting the actual key entropy of a 256 bit key to 160
bits seems at best suboptimal.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 15:29:55 -0400

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    Paul> [Paul Leach] Are you saying that AES keys bigger that 128
    Paul> bits offer no additional strength because the block size of
    Paul> AES is 128 bits?

No.

    Paul> If not, then limiting the actual key entropy of a 256 bit
    Paul> key to 160 bits seems at best suboptimal.

Yes, fortunately the entropy of a PRF comes from its key not its
input.  Thus the 256-bit AES PRF has 256-bits of entropy in its
output.

--Sam