Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 12:06:18 -0700

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Monday, September 27, 2004 11:52 AM
> To: Paul Leach
> Cc: Sam Hartman; Liqiang(Larry) Zhu; Jeffrey Altman;
[email-masked];
> Ken Raeburn
> Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF
> 
> 
> It does not mean that.  It means that you have to construct a PRF+
that
> does use more than 160 bits of entropy from its inputs.
[Paul Leach] How, pray tell, could that work? You can't get more entropy
in the output than is present in the inputs.

E.g, if the PRF generates 160 bit outputs, and the PRF+ extends them to
256 bits, a brute force attack on the cipher would only require me to
search a 2^160 space.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 14:08:35 -0500

> 256 bits, a brute force attack on the cipher would only require me to

Not so!  A PRF+ is not an expansion function.

Nico
--