Subject: RE: PKINIT-18 comments

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 14 Apr 2004 11:48:58 -0700

This one has a few relevant references.

http://www.watersprings.org/pub/id/draft-orman-public-key-lengths-08.txt

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Wednesday, April 14, 2004 11:07 AM
To: Liqiang(Larry) Zhu
Cc: Brian Tung; Eric Rosenfeld; [email-masked]
Subject: Re: PKINIT-18 comments

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:

    Liqiang(Larry)>  Sam Hartman wrote:
    >> I object to anything that depends on a specific hash or crypto
    >> system.

    Liqiang(Larry)> If only the key-generation seed length K were just
    Liqiang(Larry)> the lower bound of the seed, that way, we do not
    Liqiang(Larry)> need to depend on a specific hash. Can this be
    Liqiang(Larry)> handled in the author's last 24 hours?

LNo absolutely not; it would require significant changes to every crypto
system because you'd have to specify what happens if you get more than k
bits.

That boils down to getting a good string2key function and as far as I
know (a few years out of date), that is an open problem in cryptography.
There are things like pbkdf2 that we *think* work well, but we don't
have good proofs for.

I expect we can easily see how bad truncating a DH value is from an hour
or two reviewing a group theory text.  I expect it won't be bad at all.