Subject: PKINIT-19 comments

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 27 Apr 2004 02:24:14 -0700

1) DH key agreement: initial conversation with Dan Simon at Microsoft
indicated that the truncation is probably safe. I am not sure if I can
answer Sam's the questions at this point, but one suggestion that Dan
brought up is that why can't we just allow for negotiation and support
of multiple algorithms for the pseudorandom function/MAC calculation?
Sam you won't object to hashing the entire ZZ if we can do it without
depending on a particular checksum algorithm, correct?

Here I propose adding a checksum type field into the KDCDHKeyInfo that
is going to use for symmetric key derivations (see below).

Also the KDC should be able to insert some randomness if it decides to
use cached DH, to mitigate the threat of stolen-session-keys:

   KDCDHKeyInfo ::= SEQUENCE {
        << cut >>
        HMAC-PRF-Cksumtype            [3] Int32 OPTIONAL, 
               -- used in HMAC to derive a symmetric key from ZZ, 
               -- this is an un-keyed checksum.
               -- if absent, use truncation of ZZ as the key 
               -- generation seed
        Additional-data-to-hash       [4] OCTET STRING OPTIONAL, 
               -- append it to ZZ before key derivations if applicable
        ...
    }

2) we should define mandatory-to-implement certificate mapping, this is
the way toward having interoperable and consistent behavior among
different implementations. I can send the initial proposal for this
item.

Also, I am interested in seeing some response to Love's comments,
particularly related to how the client can assure the KDC certificate is
from a trusted KDC.

Thanks,

Larry

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 27 Apr 2004 10:48:21 -0500

>                -- append it to ZZ before key derivations if applicable

While I think this would be nice, we don't need this in order to "ship"
a PKINIT spec -- we can add features later.

> different implementations. I can send the initial proposal for this

What's wrong with having subjectAltName as mandatory to implement?

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Tue, 27 Apr 2004 14:46:55 -0400

Assuming that Jonathan's claim that the distribution of (g^x)^y mod p
is uniform can be proven, then I believe that the truncation can be
proven as secure as DH.  Thus I object to the additional complexity of
hashing anything.

Once I understand what hashing something buys us, then I will probably not object to the complexity if there is negotiation.

--Sam

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 30 Apr 2004 10:16:49 -0500

On Tue, Apr 27, 2004 at 02:46:55PM -0400, Sam Hartman wrote:
Sam> Assuming that Jonathan's claim that the distribution of (g^x)^y
Sam> mod p is uniform can be proven, then I believe that the
Sam> truncation can be proven as secure as DH.  Thus I object to the
Sam> additional complexity of hashing anything.

Sam> Once I understand what hashing something buys us, then I will
Sam> probably not object to the complexity if there is negotiation.

Sam, please review this, admitedly somewhat sloppy, proof, which we
discussed on the phone yesterday, that we cannot make any stronger
statements about the non-uniformity of the DH MSB than we can about the
DH secret itself.

Theorem:  It is as hard to prove a statement about the uniformity of the
	  distribution of the N most significant bits (within the
	  constraint that N >= sqrt(log2(p))) of a DH session key as it
	  is to prove a similar statement about the uniformity of the
	  distribution of all of the bits of a DH session key.

Proof:

 - To say that the MSB has a poor distribution implies being able to
   make statements like "the 2nd bit of the MSB has a .95 chance of
   being clear."

 - Such statements clearly apply to the entire secret as well.

 - Then by the theorem that the MSB is as hard to compute as the rest of
   the secret such a statement ought to be as hard to prove for the MSB
   as for the entire secret.

We are therefore left assume that the distribution of the MSB is as good
as that of the entire DH secret because any statement to the contrary is
as difficult to prove as any statemement about the distribution of the
entire DH secret.

Cheers,

Nico
--