Subject: Re: [Ietf-krb-wg] Standardizing Key Derivation Functions

From: Simon Josefsson <[email-masked]>
Date: Fri, 27 Mar 2009 09:41:34 +0100

The presentation below at SAAG is relevant to the krb5-prf discussion.

I propose that any future Kerberos enctypes specify a "pseudo-random"
(in RFC 3961 terminology) function based on Hugo's ideas rather than 1)
re-use the RFC 3961 pseudo-random function, or 2) use the mit-prf.

Standardizing the mit-prf for the existing aes/3des enctypes may be a
good idea meanwhile.

/Simon

David McGrew <[email-masked]> writes:

> Hi,
>
> Hugo will be giving this presentation shortly to the IETF Security
> Area Advisory Group.   This note is to point it out to people in CFRG
> that are not in SAAG.
>
> http://www3.ietf.org/proceedings/09mar/slides/saag-3.ppt
>
> David
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Mon, 30 Mar 2009 23:14:45 -0400

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> The presentation below at SAAG is relevant to the krb5-prf
    Simon> discussion.  I propose that any future Kerberos enctypes
    Simon> specify a "pseudo-random" (in RFC 3961 terminology)
    Simon> function based on Hugo's ideas rather than 1) re-use the
    Simon> RFC 3961 pseudo-random function, or 2) use the mit-prf.

I object to this because Hugo's construction is based on a hash rather
than a block cipher.  There are a lot of contexts where this makes
sense, but I don't think Kerberos is one of them.  I think it would be
fine to ask Hugo to review what we're doing.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 30 Mar 2009 23:30:23 -0400

> fine to ask Hugo to review what we're doing.

I understood him to mean that at least part of the functionality could  
be implemented through a suitable block cipher as well, though the  
details weren't given in his presentation.  I haven't checked the  
paper or references.

*IF* we used a good function for the initial key generation from pass  
phrases or semi-random input strings (the "extract" operation), I'm  
not sure we'd still need Hugo's "extract-then-expand" for key  
derivation.  But taking a closer look at the properties of these  
functions -- desired and actual -- would be a good thing.  And using  
"extract-then-expand" as a defense against possible weaknesses in a  
string-to-key function we can't convince ourselves is solid might  
help, but it's not as good as finding a good string-to-key function.

Ken