Subject: Resending: Is it secure to truncate ZZ to derive shared keys

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 27 Sep 2004 15:51:57 -0700

Folks,

I just got an email from Dan Boneh that it is a mis-interpretation of
his paper that it is safe to truncate the ZZ and get the shared key. He
suggested to hash the ZZ, not just truncate it.

This is because the paper shows that sqrt(log(p)) bits are hard to
compute, but it doesn't prove that these sqrt(log(p)) are
indistinguishable from random.  For crypto application you need the
shared key to be random, not just hard to compute.

I am requesting the permission from Dan to forward his full email to
this DL.

One thing I did not understand and I did not ask (and which is now
irreverent) is that what do the MSB sqrt(log(p)) bits mean if ZZ is all
zeros, I would imagine that is possible.

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 18:01:24 -0500

Ok, so hash k_dh using, what, SHA-256?  And truncate to 128 bits for
AES-128?  What about [future] enctypes that have keys longer than 256
bits?

k = random2key(PRF(bitstring2key(k_dh), k_dh | n_c | n_s))

So we need an bitstring2key() operation and kcrypto doesn't define one.

There's a problem with kcrypto; string2key() works for UTF-8 inputs only
and we have no equivalent for bit/octet strings, nor do we have a
bitstring2UTF8().

Nico
--