Subject: RE: PKINIT-18 comments

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 14 Apr 2004 10:59:34 -0700

Sam Hartman wrote:
> I object to anything that depends on a specific hash or crypto system.

If only the key-generation seed length K were just the lower bound of
the seed, that way, we do not need to depend on a specific hash. Can
this be handled in the author's last 24 hours?

Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Wednesday, April 14, 2004 10:41 AM
To: Liqiang(Larry) Zhu
Cc: Brian Tung; Eric Rosenfeld; [email-masked]
Subject: Re: PKINIT-18 comments

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:

    Liqiang(Larry)> section 3.2.3.  KDC Reply
 
    >> The key is derived as follows: Both the KDC and the client
    >> calculate the value g^(ab) mod p, where a and b are the
    >> client's and KDC's private exponents, respectively.  They both
    >> take the first k bits of this secret value as a key generation
    >> seed, where the parameter k (the size of the seed) is dependent
    >> on the selected key type, as specified in the Kerberos crypto
    >> draft [15].  The seed is then converted into a protocol key by
    >> applying to it a random-to-key function, which is also
    >> dependent on key type.

    Liqiang(Larry)> Simply truncating ZZ probably won't preserve the
    Liqiang(Larry)> secret entropy. why don't you use the key
    Liqiang(Larry)> generation algorithms specified in RFC 2631?

I think truncating is going to be fine based on my understanding
although it is probably worth sitting down with either a group theory
text or cryptographer.

I object to anything that depends on a specific hash or crypto system.

---

From: Sam Hartman <[email-masked]>
Date: Wed, 14 Apr 2004 14:06:33 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    >> I object to anything that depends on a specific hash or crypto

    Liqiang(Larry)> If only the key-generation seed length K were just
    Liqiang(Larry)> the lower bound of the seed, that way, we do not
    Liqiang(Larry)> need to depend on a specific hash. Can this be
    Liqiang(Larry)> handled in the author's last 24 hours?

LNo absolutely not; it would require significant changes to every
crypto system because you'd have to specify what happens if you get
more than k bits.

That boils down to getting a good string2key function and as far as I
know (a few years out of date), that is an open problem in
cryptography.  There are things like pbkdf2 that we *think* work well,
but we don't have good proofs for.

I expect we can easily see how bad truncating a DH value is from an
hour or two reviewing a group theory text.  I expect it won't be bad
at all.