Subject: RE: Deriving a symmetric key from the DH key

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 19 Oct 2004 11:29:51 -0700

Sam Hartman wrote:
> that h had no extra bits or structure.

Agreed. This should be clarified as follows.

   H is selected by the client.  H MUST be cryptographically 
   strong (e.g. H(octet string)->octet string = get_mic(dummy-key)
   SHALL NOT have extra structures in the output), otherwise 
   the KDC MUST return error code KDC_ERR_PA_CHECKSUM_TOO_WEAK (77). 

Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Tuesday, October 19, 2004 11:23 AM
To: Liqiang(Larry) Zhu
Cc: Paul Leach; [email-masked]; [email-masked]
Subject: Re: Deriving a symmetric key from the DH key

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:

    Paul> No, I didn't agree with this. get_mic is not a hash.

    Liqiang(Larry)>  Get_mic() can be a hash, and this proposal only
    Liqiang(Larry)> accepts those unkeyed get_mic() operations that
    Liqiang(Larry)> are hashes. See below.

O, so you did.  I even looked at that change although I thought you were
more concerned with making sure that h was a cryptographically strong
hash than that h had no extra bits or structure.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 19 Oct 2004 14:33:03 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    >> that h had no extra bits or structure.

    Liqiang(Larry)> Agreed. This should be clarified as follows.

    Liqiang(Larry)>    H is selected by the client.  H MUST be
    Liqiang(Larry)> cryptographically strong (e.g. H(octet
    Liqiang(Larry)> string)->octet string = get_mic(dummy-key) SHALL
    Liqiang(Larry)> NOT have extra structures in the output),
    Liqiang(Larry)> otherwise the KDC MUST return error code
    Liqiang(Larry)> KDC_ERR_PA_CHECKSUM_TOO_WEAK (77).

The use of I.E. is wrong in this instance.  Cryptographically strong
does not imply no structure.  No structure is an additional
constraint.