Subject: draft-ietf-pkix-rfc2510bis-07.txt : IAK(Initial Authentication Key)

From: "Jong-Wook, Park" <[email-masked]>
Date: Thu, 13 Mar 2003 15:04:30 +0900

Hello all, 
 
As for the IAK which used for authenticating the sender,
rfc2510bis-07.txt  describes it as follows :
 
   The end entity has an out of band interaction with the CA/RA.  This
   transaction established the shared secret, the referenceNumber and
   OPTIONALLY the distinguished name used for both sender and subject
   name in the certificate template.  It is RECOMMENDED that the shared
   secret be at least 12 characters long.

But it doesn't tell how 12 characters long comes out. If anybody can
tell, please let me know the reason why.
I know this matter on the length of IAK is entirely depends on a
cryptographic problem, not PKI.
However, it would be better to comment some reasons or references, if
any,  relating to the minimal length of IAK.
 
Thanks,
Park.
 
Park, Jong-Wook
 
Security Consultant
 
Korea Information Security Agency
Korea Certification Authority Central
 
4th FL., IT-Venture Tower B/D, 78, Garak-Dong, Songpa-Gu, Seoul, Korea
138-803
Tel : +82-2-4055-432  
Fax : +82-2-4055-319
Mobile : +82-16-461-7367
E-mail :  <mailto:[email-masked]> [email-masked] or
[email-masked] 
 
Visit  <http://www.kisa.or.kr/> http://www.kisa.or.kr or
<http://www.rootca.or.kr/> http://www.rootca.or.kr for more info,
please.
 
Always Thanks !

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Sat, 15 Mar 2003 14:19:11 +0100

Jong-Wook, Park wrote:

>[...] It is RECOMMENDED that the shared
>But it doesn't tell how 12 characters long comes out.
>
I don't know the exact values on which the decision was based, but it 
comes from the conjunction of two elements.
- How long a symetric key should be to be considered secure?
- What is the entropy of the characters of the shared secret ?

The strongest challenge publicly resolved until now was to break a 64 
bits long RC5 key.
So to be secure a key must be longer than this.

The entropy of the character of the shared secret is a mesure of how 
much randomness each character brings.

The text uses the word character, not byte for the length of the shared 
secret.
I think this means it is expected that the shared secret being 
transported out of band will very often not be constituted of binary 
data, but of characters that can be spelled out or typed on a keyboard, 
just like a password and easily exchanged in a physical or voice contact 
between two people.

This means the randomness will be reduced a lot compared to a possible 
maximum of 8 bits per byte.

I don't know here how exactly the value for entropy was determined.

But a convenient rule of thumb is at most 6 bit of randomnes per character.
This comes from the fact Base64 encoding is able to encode 6 bit of data 
par character.
So if you generate a random value, encode it in base 64, you can easily 
use it as a password and each character will bring 6 bits of randomness.
Base 64 uses all aphabetic characters, upper and lower case, the digit 
character and a few more to get to 64 characters.
They are relatively easy to type or spell out.

You could use a few more characters than that, that can be typed and 
spelled out, but not very much, so it would not make a big difference.
And for each character to really bring 6 bit of randomness, therer must 
be no correlation between characters, no character that appears more 
often than another.
This means that even the best choosen shared secret will not bring much 
more than 6 bit of randomness per byte, and usually a lot less, because 
if the shared secret is created like a password, it's difficult to mix 
upper case/lower case/digit perfectly, and you could also be tempted to 
use dictionnary words, or words you can pronounce with reduces the 
randomness too.

With 6 bit par character, 12 characters make a 72 bit long key, which is 
not a very big security margin from 64 bits.
So as I said I don't know exactly how the value was determined but with 
rules of thumb, it's not very difficult to estimate it is indeed a 
minimum for a real security against brute force attacks.