Subject: Re: [Cfrg] Answers to HKDF questions

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 22 Oct 2009 19:19:49 -0400

Actually one thing I don't think I found in the paper that Hugo referred to, was why HMAC-SHA is a better *Randomizer* than SHA. Why HMAC is better than say keyed SHA is clear.

Would you care to clarify this?

________________________________
From: [email-masked] <[email-masked]>
To: Zooko Wilcox-O'Hearn <[email-masked]>
Cc: [email-masked] <[email-masked]>
Sent: Thu Oct 22 19:09:32 2009
Subject: Re: [Cfrg] Answers to HKDF questions

On Wed, Oct 21, 2009 at 11:01 PM, Zooko Wilcox-O'Hearn <[email-masked]<mailto:[email-masked]>> wrote:
Dear Hugo Krawcyck:

Thank you for the detailed answers.  I still have a question about HMAC as compared to other MACs.  Feel free to point me to existing documents if they answer my question.  Suppose I were to instantiate HKDF with the keyed PRF being a cipher based MAC such as Poly1305 instead of HMAC.  Which of the arguments for HKDF's security would still apply?

To answer these questions I need to ask you some questions myself:

Can you explain how do you plan to use poly1305 for KDF.
Is it as an extractor, or for key expansion or both? You say as a "keyed PRF": how do you get a PRF out of your MAC and where does the key to the PRF come from?
Are you going to use only the universal hash part of poly1305 or the whole construction?
If the latter, where does the key for AES come from?

In general a MAC function does not imply a good KDF. Even a good PRF does not.
(If that was the case it would have been much easier to argue that HMAC is a good basis for KDF).

If you give me more details on what you mean by your "MAC-based KDF" I can try to answer more specifically.

Hugo

---

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 22 Oct 2009 19:48:51 -0400

I do not know what you mean by "better randomizer" so I cannot answer the
question.
I can answer why it is a better extractor which is what the whole paper is
about.

One result you may want to take a look at is Coron et al. Ref [17] in my
paper.
They show something that I use but is not specific to KDFs.

They prove that HMAC (think of it as a mode of operation acting on
Merkle-Damgard functions) is random-oracle-preserving, while Merkle-Damgard
alone is not (as clearly demonstrated by extension attacks).

You can think of it as an indication that HMAC is a better
randomness-preserving function than the plain hash.
Maybe that is what you mean by "better randomizer"?

Hugo

On Thu, Oct 22, 2009 at 7:19 PM, Blumenthal, Uri <[email-masked]> wrote:

>  Actually one thing I don't think I found in the paper that Hugo referred
> to, was why HMAC-SHA is a better *Randomizer* than SHA. Why HMAC is better
> than say keyed SHA is clear.
>
> ------------------------------
>  *From*: [email-masked] <[email-masked]>
> *To*: Zooko Wilcox-O'Hearn <[email-masked]>
> *Cc*: [email-masked] <[email-masked]>
> *Sent*: Thu Oct 22 19:09:32 2009
> *Subject*: Re: [Cfrg] Answers to HKDF questions
>
>
>
> On Wed, Oct 21, 2009 at 11:01 PM, Zooko Wilcox-O'Hearn <[email-masked]>wrote:
>
>> Dear Hugo Krawcyck:
>>
>> Thank you for the detailed answers.  I still have a question about HMAC as
>> compared to other MACs.  Feel free to point me to existing documents if they
>> answer my question.  Suppose I were to instantiate HKDF with the keyed PRF
>> being a cipher based MAC such as Poly1305 instead of HMAC.  Which of the
>> arguments for HKDF's security would still apply?
>>
>>
> Is it as an extractor, or for key expansion or both? You say as a "keyed
> PRF": how do you get a PRF out of your MAC and where does the key to the PRF
> come from?