Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 13:51:32 -0500

On Mon, Sep 27, 2004 at 11:41:07AM -0700, Paul Leach wrote:
> 
> 
> > -----Original Message-----
> > From: Sam Hartman [mailto:[email-masked]]
> > Sent: Monday, September 27, 2004 11:28 AM
> > To: Liqiang(Larry) Zhu
> > Cc: Jeffrey Altman; [email-masked]; Paul Leach; Ken Raeburn
> > Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF
> 
> 
> > All you have shown is that the PRF
> > uses at most 160-bits of entropy from the functional input.  Put
> > another way, you should not call this PRF more than 2**80 times with a
> > given key.  That seems acceptable to me; if you believe it is not
> > acceptable you should have brought it up during the last call of
> > either AES or kcrypto.
> [Paul Leach] That seems clearly unacceptable -- it means that Kerberos
> in AES mode with 256 bit keys can intrinsically never get true 256 bit
> strength.

It does not mean that.  It means that you have to construct a PRF+ that
does use more than 160 bits of entropy from its inputs.  Clearly, this
is thought to be possible and, anyways, necessary, since we have many
cases where the output of a PRF does not match the size requirements of
a slot where we want to plug it.  This is why IKEv2 has a PRF+, for
example.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 15:01:08 -0400

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    >> -----Original Message----- From: Sam Hartman
    >> [mailto:[email-masked]] Sent: Monday, September 27, 2004
    >> 11:28 AM To: Liqiang(Larry) Zhu Cc: Jeffrey Altman;
    >> [email-masked]; Paul Leach; Ken Raeburn Subject: Re:
    >> Concern: Does kcrypto imply that PRF is really a PRF

    >> All you have shown is that the PRF uses at most 160-bits of
    >> entropy from the functional input.  Put another way, you should
    >> not call this PRF more than 2**80 times with a given key.  That
    >> seems acceptable to me; if you believe it is not acceptable you
    >> should have brought it up during the last call of either AES or
    >> kcrypto.
    Paul> [Paul Leach] That seems clearly unacceptable -- it means
    Paul> that Kerberos in AES mode with 256 bit keys can
    Paul> intrinsically never get true 256 bit strength.

How does it mean that?

Keep in mind that 160 bits of SHA1 is greater than 128-bits of AES
output.

Also keep in mind that you are looking at the output of a block
cipher.  Even if we were using the cipher in counter mode--that is, we
had exactly two inputs we gave the PRF, one for the first half of the
key and one for the second half of the key--we'd get good keys out.
The security of a PRF does not depend on the functional input, only on
the key.  We need to make sure we don't have collisions in the
functional input for any given key, but I don't see why that is a
problematic assumption.

--Sam

---

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 11:41:07 -0700