Subject: RE: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 23 May 2005 14:13:55 -0400

Sounds fine. Do we want to elaborate, like explain that since PRF is a
PSEUDO-random function, it does have a [usually rather long] cycle after
which the values start repeating, and we're trying to avoid it?

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Monday, May 23, 2005 1:24 PM
To: Blumenthal, Uri
Cc: Jeffrey Hutzelman; Jeffrey Altman; [email-masked]
Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

On Thu, May 19, 2005 at 01:58:18PM -0400, Blumenthal, Uri wrote:
> >>> That text does need some cleanup, and the real issue is that the
> GSS-API
> >>> can't enforce any limits on the useful lifetime of PRF output used
> for
> >>> cryptographic purposes.  So, I propose replacing that paragraph
> with:
> >>>
> >>>    Care should be taken not to exceed the useful lifetime of
> >>>    GSS_Pseudo_random() output, particularly when used for
> cryptographic
> >>>    purposes.  Specifically, applications should limit use of
> >>>    cryptographic keys derived from GSS_Pseudo_random() output to
the
> >>>    original lifetime of the security contexts to which
> >>>    GSS_Pseudo_random() is applied.
> >>>
> >>> That seems much more specific -- no handfuls, pinches or touches.
> >>
> >> I am much happier with the proposed text.   Does anyone else have
any
> >> comments?
> >
> >I have no problem with adding that text, but it sounds like it
> addresses a 
> >different problem than the paragraph Nico proposes to replace.  The 
> >existing text appears to be concerned about the amount of data which
> the 
> >PRF can safely be used to generate.
> 
> I like the above text (let it stay), but agree with Jeff - we need
> something
> else in addition. Could say something along the lines of:
> 
> 	Care should be taken not to exceed the amount of data that PRF
> can
> 	safely generate.
> 
> This amount naturally depends on the mechanisms used. :-)

This is a consideration for mechanisms as much as for applications.

Mechanisms should not allow the PRF to output more than is safe.

The mechanism-specific aspect of it is already handled in section 2.

Applications should not overuse the PRF.

So, how about:

   Applications should not overuse the PRF.  What constitutes overuse of
   the PRF may vary by mechanism and other details (such as what key
   strength has been negotiated by the mechanisms), therefore we cannot
   give precise advice, but, to be certain, limiting calls to
   GSS_Pseudo_random() to a very small number, such as one, or two
   calls, should suffice.

Nico
-- 

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 13:46:37 -0500

> which the values start repeating, and we're trying to avoid it?

I don't care -- as long as we get done with this pair of I-Ds :)

Also, I'm not sure that the period is the issue here -- for each call
the periodicity issue is handled already in section 2.  The issue is
that at some point a PRF can start leaking data.  I imagine
GSS_Pseudo_random() being used to make an XOR encryption pad, for
example -- after a while but well before the underlying PRG/PRF's period
is reached we may have other weaknesses in it leak information through
the pad, parts of which might be recoverable by attackers that know any
of the plaintext being encrypted.  IANAC, but this seems difficult to
explain, particularly in the generic function definition, rather than in
the mechanims'.

So I think vague text is the best I can do here, though I welcome
suggestions -- I'm sure others can do better than :)

Nico
--