Subject: RE: static-static DH proposal

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 24 Sep 2004 00:43:06 -0700

Humm... The function in my previous email needs a type-cast and here is
the corrected version:

-----------------------------------------------------------------------
k_dh = random-to-key(K-truncate(PRF(random-to-key(K-fold(g^xy)),
g^xy|n_c|n_k)|g^xy))

k_i = PRF(k_dh, i), i>=0

k = random-to-key(K-truncate(k_0|k_1|...))

where | is concatenation, g^xy is the shared secret from the 
Diffie-Hellman exchange, K is the key-generation seed length, 
The K-fold and PRF operations are defined in Kcrypto.
----------------------------------------------------------------------

The reply key is k.

--Larry

-----Original Message-----
From: Liqiang(Larry) Zhu 
Sent: Friday, September 24, 2004 12:24 AM
To: 'Sam Hartman'
Cc: [email-masked]
Subject: RE: static-static DH proposal

Sam Hartman wrote:
> However what you propose does not type check and is not well formed.
> k_i is not the same type or length as k_dh.  It's not a protocol key; 
> you cannot use it as the key argument to > prf.

Here is the type-safe version for deriving the reply key k:

k_dh = random-to-key(K-truncate(PRF(K-fold(g^xy), g^xy|n_c|n_k)|g^xy))
k_i = PRF(k_dh, i), i>=0
k = random-to-key(K-truncate(k_0|k_1|...))

where | is concatenation, g^xy is the shared secret from the 
Diffie-Hellman exchange, K is the key-generation seed length, 
The K-fold and PRF operations are defined in Kcrypto.

I argue for this key generation function because:
1) This adds no significant complexity
2) It is safer to include all the bits of the share secret from the DH
exchange

--Larry

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 24 Sep 2004 12:04:08 -0400

> Humm... The function in my previous email needs a type-cast and here is

Couldn't K possibly be larger than PRF|g^xy?
(Unlikely, sure, but possible?)

> k_i = PRF(k_dh, i), i>=0

The second parameter to PRF is an octet string; what's the encoding 
here?  Four octets?  Smallest number of octets that can express the 
value?  MSB or LSB first?  DER?