Subject: PRF's and PKINIT: status

From: "Paul Leach" <[email-masked]>
Date: Mon, 27 Sep 2004 18:09:54 -0700

Here's what I think the status is:

There are three issues here
1. Definition of PRF properties
2. PRF for AES
3. Whether PKINIT can just truncate the DH key to use as the secret key
input to a PRF.

WRT #1: we seem to be in agreement that its OK to assume that any PRF is
cryptographically strong (except possibly for certain legacy crypto
suites), and that we can make this explicit later. A tracking item
should be entered about it, I presume?
WRT #2: this is an independent issue from getting PKINIT settled. We
should keep the threads separate.
WRT #3: Larry's mail referenced a private exchange with Dan Boneh saying
that it wasn't safe to truncate. This needs to be dealt with (one way or
another) to finish the PKINIT draft.

Are we in synch?

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 27 Sep 2004 21:11:19 -0500

On Mon, Sep 27, 2004 at 10:07:23PM -0400, Sam Hartman wrote:
> This is an excellent summary and I'm in complete agreement.

Do you agree that there is an issue with the kcrypto PRF for AES (Paul's
issue #2)?  Or merely that such an issue has been raised?

Paul, can you clarify what exactly is issue #2?

As I see it you and/or Larry wish the size of the output of the PRF for
the AES enctype matched the size of its input key.  If this is to avoid
PRF+ constructions I must say that I'm very unsympathetic :)

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 22:31:00 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Mon, Sep 27, 2004 at 10:07:23PM -0400, Sam Hartman
    >> This is an excellent summary and I'm in complete agreement.

    Nicolas> Do you agree that there is an issue with the kcrypto PRF
    Nicolas> for AES (Paul's issue #2)?  Or merely that such an issue
    Nicolas> has been raised?

    Nicolas> Paul, can you clarify what exactly is issue #2?

    Nicolas> As I see it you and/or Larry wish the size of the output
    Nicolas> of the PRF for the AES enctype matched the size of its
    Nicolas> input key.  If this is to avoid PRF+ constructions I must
    Nicolas> say that I'm very unsympathetic :)

    Nicolas> Nico --

I agree the issue has been raised.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 27 Sep 2004 22:07:23 -0400