Subject: RE: Concern: Does kcrypto imply that PRF is really a PRF

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 27 Sep 2004 13:19:44 -0700

the attached email did not seem to go through, at least from my mail
client.

Nicolas Williams wrote:
> Larry, so far you have not convinced anyone (that I've seen) that the
document needs updating.

The PRF in kcrypto is either fatally flawed or insufficient for PKINIT,
depends on how you view it, isn't that convincing enough?

--Larry
-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Monday, September 27, 2004 1:12 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; Paul Leach; Ken Raeburn; [email-masked]
Subject: Re: Concern: Does kcrypto imply that PRF is really a PRF

On Mon, Sep 27, 2004 at 01:12:49PM -0700, Liqiang(Larry) Zhu wrote:
> 
> Jeffrey Hutzelman wrote:
> 
> > Please allow me to be clear.  This document is OUT OF OUR HANDS. 
> 
> Which way has less work? Recalling this draft now or coming up with 
> the next version of it?

Larry, so far you have not convinced anyone (that I've seen) that the
document needs updating.  Before asking that question we ought to know
what we'd be changing in the spec.  We don't.

Nico
-- 

Subject: Truncating ZZ
From: "Liqiang\(Larry\) Zhu" <[email-masked]>
To: <[email-masked]>, "Jonathan Trostle" <[email-masked]>
Date: Mon, 27 Sep 2004 12:28:59 -0700

Folks,

I just got an email from Dan Boneh that it is a mis-interpretation of
his paper that it is safe to truncate the ZZ and get the shared key. he
suggested to hash the ZZ, not just truncate it.

This is because the paper shows that sqrt(log(p)) bits are hard to
compute, but it doesn't prove that these sqrt(log(p)) are
indistinguishable from random.  For crypto application you need the
shared key to be random, not just hard to compute.

I am requesting the permission from Dan to forward his full email to
this DL.

One thing I did not understand and I did not ask (and which is now
irreverent) is that what do the MSB sqrt(log(p)) bits mean if ZZ is all
zeros, I would imagine that is possible.

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 15:30:00 -0500

> depends on how you view it, isn't that convincing enough?

We have not established that.  We are nowhere near establishing that in
this thread.

You want a PRF that outputs exactly (or at least) as many bits as the
input key.  Others maintain that a PRF+ is sufficient to obtain the
number of bits you want.  You have not made any convincing statements
about the inadequacy of a PRF+ or the kcrypto PRF construction.

Before we make statements like "[the] PRF in kcrypto is either fatally
flawed or insufficient for PKINIT" we should, methinks, establish that
it actually is, or even strong doubt, actual collisions, say.  Yes, we
should also establish that the kcrypto PRF is at least good enough for
PKINIT, and Sam has, in fact, ably defended the strength of the kcrypto
PRF construction, while Jeff just pointed out that the stated qualities
of the kcrypto PRF appear to meet PKINIT's needs.

Also, I showed that PRF+'s will be necessary for one thing or another,
and we've established that a PRF+ is not, contrary to Paul's
implication, merely an expansion function.

Nico
--