Subject: RE: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 23 May 2005 14:23:30 -0700

It seems that this text and discussion really belongs in
draft-ietf-kitten-gssapi-prf since the concerns are not Kerberos
mechanism specific.  
 
Joe

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]] 
> Sent: Monday, May 23, 2005 12:36 PM
> To: Ken Raeburn
> Cc: [email-masked]
> Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt
> 
> On Mon, May 23, 2005 at 03:28:22PM -0400, Ken Raeburn wrote:
> > On May 23, 2005, at 14:39, Nicolas Williams wrote:
> > >>One or two calls?  That sounds really weak.  I would hope 
> one or two 
> > >>dozen -- or one or two thousand -- should be possible for 
> even the 
> > >>weakest cryptosystem without compromising security.
> > >
> > >But we can't really say, can we -- the mechs should, and then, for 
> > >the
> > >krb5 mech the recommendation will depend on enctypes used, 
> which the 
> > >application doesn't know about and has not control over.
> > >
> > >Perhaps the text shouldn't say "one or two" or any number.
> > 
> > In the end, it does all come down to the security of the individual 
> > cryptosystem specification.  But I think one that can't 
> handle a few 
> > thousand PRF calls (of small blocks, not unbounded size) is either 
> > horribly weak, or has a PRF function which is exceedingly weak 
> > compared to the rest of the cryptosystem.  (But since we 
> consider the 
> > PRF a part of the cryptosystem, it could be argued that the 
> latter is 
> > just a special case of the former.  And with a horribly weak 
> > cryptosystem, you're just doomed...)
> 
> Ok, so shall I s/one, or two/one, or two thousand/?  :)
> 
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/kitten
> 

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 16:23:53 -0500

> draft-ietf-kitten-gssapi-prf since the concerns are not Kerberos

That is the I-D we're actually discussing.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 23 May 2005 17:42:45 -0400

> That is the I-D we're actually discussing.

Yeah, can't you tell from the message subjects? :-)

---

From: Jeffrey Altman <[email-masked]>
Date: Wed, 25 May 2005 11:03:02 -0400

Actually, the question I raised was on the krb5 prf draft since that is
where the current text is located.  I would like a consensus call on the
following questions.

(1) Add this text to the security considerations section of the
    general prf draft:

Pseudorandom functions by their nature are capable of producing only
limited amounts of cryptographically secure output. The exact amount of
output that one can safely use, unfortunately varies from one PRF to
another (which prevents us from recommending specific numbers). Because
of this, we recommend that unless you really know what you are doing
(i.e. you are a cryptographer and are qualified to pass judgement on
cryptographic functions in areas of period, presence of short cycles,
etc), you limit the amount of the PRF output used to the necessary minimum.

(2) Remove from the security consideration section of the krb5 prf
    draft:

Care should be taken not to exceed the useful lifetime of an
established security context's session key's useful lifetime as
implementations are not required to prevent overuse of the
GSS_Pseudo_random() function.  This can effectively be achieved by
limiting the number of GSS_Pseudo_random() calls to, say, a handful
of calls per-security context.

Jeffrey Altman