Subject: Concern: Does kcrypto imply that PRF is really a PRF

From: Sam Hartman <[email-masked]>
Date: Sat, 25 Sep 2004 19:27:02 -0400

Larry brings up a concern in private mail.  He's concerned that the
definition of PRF in kcrypto is not sufficiently clear that we
actually mean a cryptographic PRF.  My reading of the text is that
we're describing some properties that a PRF has in kcrypto, but we're
not attempting to define a PRF.

I think clarifying this text when we go to draft standard is fine
although perhaps not strictly required.  I think delaying publication
for yet one more IESG round trip is undesirable.

Does the working group agree that it is our intent that PRFs used for
kcrypto be cryptographically strong PRFs meeting with generally
accepted definitions?

--Sam

---

From: Jeffrey Altman <[email-masked]>
Date: Sat, 25 Sep 2004 19:38:03 -0400

> kcrypto be cryptographically strong PRFs meeting with generally

Under what circumstances would be appropriate for the kcrypto PRF
to not be cryptographically strong?

Given our intended uses I agree that the kcrypto PRF must be 
cryptographically strong.

Jeffrey Altman