Subject: Re: static-static DH and pkinit

From: Sam Hartman <[email-masked]>
Date: Tue, 21 Sep 2004 15:27:40 -0400

>>>>> "Sam" == Sam Hartman <[email-masked]> writes:

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:
    Sam>     Liqiang(Larry)> Sam Hartman wrote:
    >>> > Liqiang(Larry)> Try something CBC alike:

    >>> I don't know how to do security proofs for this; I know how to
    >>> do security proofs for what I proposed.  What advantage do you
    >>> hope to get out of something CBC-like?

    Sam>     Liqiang(Larry)> Since everybody else does the
    Sam> Liqiang(Larry)> pseduo-CBC-alike-with-feedback algorithms, I
    Sam> guess Liqiang(Larry)> why not here?

    Sam>     Liqiang(Larry)> Let me send a email to Dan Simon to see
    Sam> what he Liqiang(Larry)> thinks too. It might be that the
    Sam> difference is Liqiang(Larry)> marginal.

    Sam> So, Nico points out that the security proof actually works
    Sam> either way.  I don't object to the CBC-based solution
    Sam> although I don't currently see the point.

I mentioned this to Larry in some thread, but don't seem to have done
so in this thread.  For the record, the CBC-like solution doesn't
actually work because the length of k_dh is not guaranteed to be the
same as the length of k_i.  Also, they don't type match: k_i is a bit
string and k_dh is a protocol key.  If k_i is the same length as k_dh,
you only need one round of the PRF.  So I don't think the CBC
construction meets our needs.  Since everyone seemed to think my
original construction is secure I'm going to take it plus Paul's
modification for performance as the basis of changes I suggest to the
document.

--Sam