Subject: RE: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 23 May 2005 17:11:01 -0400

IMHO if a PRF can handle only a dozen or so calls - it's so
cryptographically weak that it doesn't belong anyway. It should suffice
for us to mention the reason why the user may want to limit the amount
of PRF output.

I don't think a good PRF would leak any material except for when its
period is reached (a good PRF won't have short cycles either).

So we can drop giving concrete numbers (after all, if we don't know the
underlying crypto - we can't tell how many bits the resulting PRF can
safely output), but just say that because of <a>, <b> and <c> the user
should take care and limit the number of PRF invocations/output bits.

Does this make sense?

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Nicolas Williams
Sent: Monday, May 23, 2005 3:36 PM
To: Ken Raeburn
Cc: [email-masked]
Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

On Mon, May 23, 2005 at 03:28:22PM -0400, Ken Raeburn wrote:
> On May 23, 2005, at 14:39, Nicolas Williams wrote:
> >>One or two calls?  That sounds really weak.  I would hope one or two
> >>dozen -- or one or two thousand -- should be possible for even the
> >>weakest cryptosystem without compromising security.
> >
> >But we can't really say, can we -- the mechs should, and then, for
the
> >krb5 mech the recommendation will depend on enctypes used, which the
> >application doesn't know about and has not control over.
> >
> >Perhaps the text shouldn't say "one or two" or any number.
> 
> In the end, it does all come down to the security of the individual 
> cryptosystem specification.  But I think one that can't handle a few 
> thousand PRF calls (of small blocks, not unbounded size) is either 
> horribly weak, or has a PRF function which is exceedingly weak
compared 
> to the rest of the cryptosystem.  (But since we consider the PRF a
part 
> of the cryptosystem, it could be argued that the latter is just a 
> special case of the former.  And with a horribly weak cryptosystem, 
> you're just doomed...)

Ok, so shall I s/one, or two/one, or two thousand/?  :)

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 16:16:07 -0500

> should take care and limit the number of PRF invocations/output bits.

Ok.  Text please?