Subject: RE: static-static DH proposal

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 24 Sep 2004 00:24:13 -0700

Sam Hartman wrote:
> However what you propose does not type check and is not well formed.
> k_i is not the same type or length as k_dh.  It's not a protocol key; 
> you cannot use it as the key argument to > prf.

Here is the type-safe version for deriving the reply key k:

k_dh = random-to-key(K-truncate(PRF(K-fold(g^xy), g^xy|n_c|n_k)|g^xy))
k_i = PRF(k_dh, i), i>=0
k = random-to-key(K-truncate(k_0|k_1|...))

where | is concatenation, g^xy is the shared secret from the 
Diffie-Hellman exchange, K is the key-generation seed length, 
The K-fold and PRF operations are defined in Kcrypto.

I argue for this key generation function because:
1) This adds no significant complexity
2) It is safer to include all the bits of the share secret from the DH
exchange

--Larry

---

From: Sam Hartman <[email-masked]>
Date: Fri, 24 Sep 2004 15:53:01 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> 1) This adds no significant complexity 

2) It is
    Liqiang(Larry)> safer to include all the bits of the share secret
    Liqiang(Larry)> from the DH exchange

As I understand it, Larry is reopening what I thought was a closed
issue: are we using truncation to get the DH key.

I don't mind reopening that issue, but I want to be clear that's what
we're trying to do.

 I don't see why including all the bits of the shared DH
key is safer.