Subject: RE: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 19 May 2005 13:58:18 -0400

>>> That text does need some cleanup, and the real issue is that the
GSS-API
>>> can't enforce any limits on the useful lifetime of PRF output used
for
>>> cryptographic purposes.  So, I propose replacing that paragraph
with:
>>>
>>>    Care should be taken not to exceed the useful lifetime of
>>>    GSS_Pseudo_random() output, particularly when used for
cryptographic
>>>    purposes.  Specifically, applications should limit use of
>>>    cryptographic keys derived from GSS_Pseudo_random() output to the
>>>    original lifetime of the security contexts to which
>>>    GSS_Pseudo_random() is applied.
>>>
>>> That seems much more specific -- no handfuls, pinches or touches.
>>
>> I am much happier with the proposed text.   Does anyone else have any
>> comments?
>
>I have no problem with adding that text, but it sounds like it
addresses a 
>different problem than the paragraph Nico proposes to replace.  The 
>existing text appears to be concerned about the amount of data which
the 
>PRF can safely be used to generate.

I like the above text (let it stay), but agree with Jeff - we need
something
else in addition. Could say something along the lines of:

	Care should be taken not to exceed the amount of data that PRF
can
	safely generate.

This amount naturally depends on the mechanisms used. :-)

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 12:24:07 -0500

> This amount naturally depends on the mechanisms used. :-)

This is a consideration for mechanisms as much as for applications.

Mechanisms should not allow the PRF to output more than is safe.

The mechanism-specific aspect of it is already handled in section 2.

Applications should not overuse the PRF.

So, how about:

   Applications should not overuse the PRF.  What constitutes overuse of
   the PRF may vary by mechanism and other details (such as what key
   strength has been negotiated by the mechanisms), therefore we cannot
   give precise advice, but, to be certain, limiting calls to
   GSS_Pseudo_random() to a very small number, such as one, or two
   calls, should suffice.

Nico
--

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 23 May 2005 14:27:52 -0400

>    GSS_Pseudo_random() to a very small number, such as one, or two

One or two calls?  That sounds really weak.  I would hope one or two 
dozen -- or one or two thousand -- should be possible for even the 
weakest cryptosystem without compromising security.

Ken

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 13:39:18 -0500

> weakest cryptosystem without compromising security.

But we can't really say, can we -- the mechs should, and then, for the
krb5 mech the recommendation will depend on enctypes used, which the
application doesn't know about and has not control over.

Perhaps the text shouldn't say "one or two" or any number.

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 23 May 2005 15:28:22 -0400

> Perhaps the text shouldn't say "one or two" or any number.

In the end, it does all come down to the security of the individual 
cryptosystem specification.  But I think one that can't handle a few 
thousand PRF calls (of small blocks, not unbounded size) is either 
horribly weak, or has a PRF function which is exceedingly weak compared 
to the rest of the cryptosystem.  (But since we consider the PRF a part 
of the cryptosystem, it could be argued that the latter is just a 
special case of the former.  And with a horribly weak cryptosystem, 
you're just doomed...)

ken

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 14:36:17 -0500

> special case of the former.  And with a horribly weak cryptosystem, 

Ok, so shall I s/one, or two/one, or two thousand/?  :)

---

From: Sam Hartman <[email-masked]>
Date: Mon, 23 May 2005 19:13:14 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Thu, May 19, 2005 at 01:58:18PM -0400, Blumenthal, Uri
    Nicolas> wrote:
    >> >>> That text does need some cleanup, and the real issue is
    >> that the GSS-API >>> can't enforce any limits on the useful
    >> lifetime of PRF output used for >>> cryptographic purposes.
    >> So, I propose replacing that paragraph with:
    >> >>>
    >> cryptographic >>> purposes.  Specifically, applications should
    >> limit use of >>> cryptographic keys derived from
    >> GSS_Pseudo_random() output to the >>> original lifetime of the
    >> security contexts to which >>> GSS_Pseudo_random() is applied.
    >> >>>
    >> >> I am much happier with the proposed text.  Does anyone else
    >> have any >> comments?
    >> >
    >> addresses a >different problem than the paragraph Nico proposes
    >> to replace.  The >existing text appears to be concerned about
    >> the amount of data which the >PRF can safely be used to
    >> generate.
    >> 
    >> I like the above text (let it stay), but agree with Jeff - we
    >> need something else in addition. Could say something along the
    >> lines of:
    >> 
    >> can safely generate.

    Nicolas> This is a consideration for mechanisms as much as for
    Nicolas> applications.

    Nicolas> Mechanisms should not allow the PRF to output more than
    Nicolas> is safe.

I'm not sure that this is true.  I think it is a system level concern
and like Uri's original text.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 24 May 2005 12:27:39 -0500

> and like Uri's original text.

I'm losing track.

Can we some sense of whether this is ready for WG Last Call?

We seem to be arguing about security considerations only, rather than
over any technical details.

Nico
--