Subject: RE: PRF's and PKINIT: status

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 28 Sep 2004 12:59:17 -0700

Ken Raeburn wrote:
> Why do you refuse to address the matter on the PKINIT side?  
> For one thing, the "sparsely-populated entropy" could be dealt 
> with in a way specific to the structure of the bit string available.  
> Or, currently, PKINIT already specifies sha1 in a couple places, so
why not just build a PRF+ on it?

We need to have the ability to negotiate hash algorithms, and kcrypto is
the way to go. It is a failure of kcrypto if it is not sufficient for
PKINIT, not to mention other application protocols built on top of
Kerberos.

-- Larry

-----Original Message-----
From: Ken Raeburn [mailto:[email-masked]] 
Sent: Tuesday, September 28, 2004 12:51 PM
To: Liqiang(Larry) Zhu
Cc: <[email-masked]>
Subject: Re: PRF's and PKINIT: status

On Sep 28, 2004, at 15:33, Liqiang(Larry) Zhu wrote:
> We have two choices here: delaying kcrypto or delaying PKINIT.

I don't agree with that list of options.

PKINIT needs work to deal with crypto stuff.  That's true whether
kcrypto is changed to add the stuff you want or not.  I see no
additional delay in doing the work in PKINIT.

>  I would
> prefer the former. I do not understand what we gain by having an 
> incomplete kcrypto published at all cost.

Still not convinced it's incomplete, or that a second version is needed.

> I believe strongly that kcrypto is fatally flawed when it does not 
> include an operation that can take a long bitstring with 
> sparsely-populated entropy.
>
> I prefer to extend random-to-key to take bitstring of arbitrary 
> length, and make the new definition to be backward-compatible.  With 
> that, the reply key k can simply be random-to-key(ZZ | n_c | n_k).

Why do you refuse to address the matter on the PKINIT side?  For one
thing, the "sparsely-populated entropy" could be dealt with in a way
specific to the structure of the bit string available.  Or, currently,
PKINIT already specifies sha1 in a couple places, so why not just build
a PRF+ on it?

Ken

---

From: Sam Hartman <[email-masked]>
Date: Tue, 28 Sep 2004 18:10:23 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> We need to have the ability to negotiate hash
    Liqiang(Larry)> algorithms, and kcrypto is the way to go. 

We've already said it was wrong for pkinit to negotiate CMS enctypes
by bootstrapping on kcrypto; I think a similar argument can be made
for the function used to map a string into a random bitstring.

--Sam