Subject: [Ietf-krb-wg] CF2 test vectors for DES and 3DES

From: Sam Hartman <[email-masked]>
Date: Thu, 30 Apr 2009 16:31:31 -0400

Folks, there seems to be yet another inconsistency between RFC 3961
and MIT regarding DES and presumably 3DES random2key operations.

MIT assumes that DES random bit strings are 7 byte strings that are
expanded with parity bits.  The RFC 3961 spec assumes that you take an
eight byte string and do parity fix-up.

I suspec Heimdal does the same thing as MIT here because we seem to
interoperate for PKINIT and this issue comes up there too.

This is also a big issue for CF2.  Attached are DES and 3DES results
for KRB-FX-CF2.  In both cases key1 is string_to_key("key1", "key1",
default_params) and key2 is string_to_key("key2","key2",
default_params).  The pepper1 is a; the pepper2 is b.

des: 43bae3738c9467e6
des3: e58f9eb643862c13ad38e529313462a7f73e62834fe54a01

Note that both of those are protocol keys--they have already been
expanded and parity fixed.

I'd definitely appreciate confirmation of these test vectors from
people.  If you run into trouble, I can provide the PRF inputs that
are used.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 30 Apr 2009 17:27:52 -0400

> eight byte string and do parity fix-up.

I think this is an API issue.  The 3961 random-to-key operation is defined 
in terms of an input bitstring of a particular size.  For single-DES, the 
last paragraph before 6.2.1 says...

   For generation of a key from a random bitstring, we start with a 56-
   bit string and, as with the string-to-key operation above, insert
   parity bits.  If the result is a weak or semi-weak key, we modify it
   by eXclusive-OR with the constant 0x00000000000000F0:

        des_random_to_key(bitstring) {
             return key_correction(add_parity_bits(bitstring));
        }

Thus, 3961 assumes you start with a 56-bit string.  Whether that string is 
represented as seven 8-bit bytes of keying material or as eight 7-bit bytes 
of keying material in 8-bit fields is an implementation matter.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Thu, 30 Apr 2009 17:45:44 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> --On Thursday, April 30, 2009 04:31:31 PM -0400 Sam
    Jeffrey> Hartman
    Jeffrey> <[email-masked]> wrote:

    >> expanded with parity bits.  The RFC 3961 spec assumes that you
    >> take an eight byte string and do parity fix-up.

    Jeffrey> I think this is an API issue.  The 3961 random-to-key
    Jeffrey> operation is defined in terms of an input bitstring of a
    Jeffrey> particular size.  For single-DES, the last paragraph
    Jeffrey> before 6.2.1 says...

No.  I'm fairly sure it produces different results with CF2.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 30 Apr 2009 20:37:31 -0700

> interoperate for PKINIT and this issue comes up there too.

I don't think most people use DES with PK-INIT.

In heimdal DES3 does what you describe (uses 3 * 8), DES doesn't (uses  
8 bytes).

Love

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 30 Apr 2009 20:38:27 -0700

30 apr 2009 kl. 20:37 skrev Love Hörnquist Åstrand:

> In heimdal DES3 does what you describe (uses 3 * 8), DES doesn't  
> (uses 8 bytes).

3 * 7 bytes for DES3

Love