Subject: RE: static-static DH proposal

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 24 Sep 2004 13:04:48 -0700

Sam Hartman wrote:
> I don't see why including all the bits of the shared DH key is safer.

Let me put it into another way, we are creating a brand new key
generation function, and it does not hurt to include all the bits of the
share secret. 

In this field, folks have learned not to live on the edge, and I do not
think the practice of truncating the DH shared key is as
popular/established as the PRF+ approach in IKEv2 and PEAP at this
point.

do you agree with my two points above?

--Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Friday, September 24, 2004 12:53 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: static-static DH proposal

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:

    Liqiang(Larry)> 1) This adds no significant complexity 

2) It is
    Liqiang(Larry)> safer to include all the bits of the share secret
    Liqiang(Larry)> from the DH exchange

As I understand it, Larry is reopening what I thought was a closed
issue: are we using truncation to get the DH key.

I don't mind reopening that issue, but I want to be clear that's what
we're trying to do.

 I don't see why including all the bits of the shared DH key is safer.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 24 Sep 2004 15:06:03 -0500

> generation function, and it does not hurt to include all the bits of the

We've established that it is Ok to truncate the DH secret -- to a point.
See previous posts.

That said, I don't care if you truncate or not.

> popular/established as the PRF+ approach in IKEv2 and PEAP at this

Well, I'm not sure I really like the chaining in the IKEv2 PRF+ -- Sam's
counter construction seemed just as well and simpler -- and I suspect
that the theory behind PRF+ design is not well settled.

> do you agree with my two points above?

No, more like "I don't care."

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 24 Sep 2004 16:25:37 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    >> I don't see why including all the bits of the shared DH key is

    Liqiang(Larry)> Let me put it into another way, we are creating a
    Liqiang(Larry)> brand new key generation function, and it does not
    Liqiang(Larry)> hurt to include all the bits of the share secret.

If you can show me that it does not hurt to include all the bits in
the way that you are proposing, you will go a long way to making me
feel comfortable with your proposal.