Subject: Re: [eap] questions about PRF in eap-sim-11.txt

From: <[email-masked]>
Date: Tue, 16 Sep 2003 14:59:22 +0300

Michael,

Please find a test run of an implementation of the NIST PRF 
below. The details of running the G function are shown in 
the attachment. It gives the same result as the NIST example, 
so it should be correct. Thanks to Jukka-Pekka Honkanen
for providing the test runs.

If you can verify that you get the same results with
your implementation, then I think we could use include
these test vectors to EAP SIM and EAP AKA drafts.
They would be useful in verifying the PRF implementation.

Regards,
Henry

--

# Copied from "Multiple Examples of DSA" http://csrc.nist.gov/encryption/dss/Examples-1024bit.pdf
# Using the revised algorithm found in the Change Notice for the generation of x values:
# XKEY= bd029bbe 7f51960b cf9edb2b 61f06f0f eb5a38b6
# XSEED= 00000000 00000000 00000000 00000000 00000000
# The first loop through step 3.2 provides:
# XVAL= bd029bbe 7f51960b cf9edb2b 61f06f0f eb5a38b6
# Using the routine in Appendix 3.3 Constructing The Function G From SHA-1
# provides:
# w[0]= 2070b322 3dba372f de1c0ffc 7b2e3b49 8b260614
# The following value is the updated XKEY value from step 3.2.c:
# XKEY= dd734ee0 bd0bcd3b adbaeb27 dd1eaa59 76803ecb
# The second loop through step 3.2 provides:
# XVAL= dd734ee0 bd0bcd3b adbaeb27 dd1eaa59 76803ecb
# Using the routine in Appendix 3.3 Constructing The Function G From SHA-1
# provides:
# w[1]= 3c6c18ba cb0f6c55 babb1378 8e20d737 a3275116
# The following value is the updated XKEY value from step 3.2.c:
# XKEY= 19df679b 881b3991 6875fea0 6b3f8191 19a78fe2
# Step 3.3 provides the following values:
# w[0] || w[1]= 2070b322 3dba372f de1c0ffc 7b2e3b49 8b260614
#               3c6c18ba cb0f6c55 babb1378 8e20d737 a3275116

frame # This is xkey input to dss_random().
{
	0xbd, 0x02, 0x9b, 0xbe, 0x7f, 0x51, 0x96, 0x0b,
	0xcf, 0x9e, 0xdb, 0x2b, 0x61, 0xf0, 0x6f, 0x0f,
	0xeb, 0x5a, 0x38, 0xb6
}

frame # This is the correct output from dss_random().
{
	0x20, 0x70, 0xb3, 0x22, 0x3d, 0xba, 0x37, 0x2f,
	0xde, 0x1c, 0x0f, 0xfc, 0x7b, 0x2e, 0x3b, 0x49,
	0x8b, 0x26, 0x06, 0x14, 0x3c, 0x6c, 0x18, 0xba,
	0xcb, 0x0f, 0x6c, 0x55, 0xba, 0xbb, 0x13, 0x78,
	0x8e, 0x20, 0xd7, 0x37, 0xa3, 0x27, 0x51, 0x16
}

---

From: Michael Richardson <[email-masked]>
Date: Tue, 16 Sep 2003 12:22:33 -0400

-----BEGIN PGP SIGNED MESSAGE-----

Henry, I already tested against those test vectors. That's why I knew
that I had the code wrong, and how I determined what was correct.

Input was: |bd029bbe_7f51960b_cf9edb2b_61f06f0f_eb5a38b6|
Output was: 2070b322_3dba372f_de1c0ffc_7b2e3b49_8b260614
            3c6c18ba_cb0f6c55_babb1378_8e20d737_a3275116
            c9ec5c2f_3261cba3_98384ecf_9189707c_20dbe3b6
            8d6fc9d2_37313854_7338c3f5_7cf68f38_683aea5b
            f9e60c0d_73b177bc_69edde1b_eb3f596a_9555fee9
            0d570204_a3044bb5_a67f6509_25f14c1d_0446b252
            78360140_28faffbf_49840408_ccb30408_00b40408
            38faffbf_18ef0440_48ae1340_c0970040_48faffbf

Your test vector does not provide the entire 1280 bits of keying needed
to verify all of EAP-SIM's calculations.

]      Out and about in Ottawa.    hmmm... beer.                |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap