8 Feb 2010 22:01
Re: comments and questions on draft-krawczyk-hkdf and related work
David McGrew <mcgrew <at> cisco.com>
2010-02-08 21:01:19 GMT
2010-02-08 21:01:19 GMT
Hi Hugo, I never heard back from you on my security questions about HKDF. I'm resending the original email from last year, with the questions that Pasi answered stripped out. On Oct 20, 2009, at 2:43 PM, David McGrew wrote: > Hi Hugo and Pasi, > > I have some comments and questions on draft-krawczyk-hkdf-00 and "On > Extract-then-Expand Key Derivation Functions and an HMAC-based KDF". > First, thanks for taking on this work; it makes strong contributions > in an important area. > > The most important question is: what is the precise security statement > for HKDF? What assumptions does one need to make about the hash > function used in HKDF in order that the security analysis applies? > The paper says that "it is shown in [23] (see Section 8) that using > HMAC with a truncated output as an extractor allows to prove security > under considerably weaker assumptions on the underlying hash > function." However, both of the Lemmas in that paper (and the > implication in Section 8) make random oracle assumptions. > > A recommended instantiation of HKDF from the paper uses HMAC-SHA-512 > (with output truncated to 256 bits) in the extract stage and > HMAC-SHA-256 in the expand stage. I understand from [23] that "if we > are interested in an output of L close-to-uniform bits then the key to > the underlying compression function needs to be sufficiently larger > than L," which motivates the use of SHA-512 in the extraction stage.(Continue reading)
On the vendor side - perhaps EKE patent concern was the cause (you implement/sell free SRP and get slapped
with EKE licensing)? And the users found alternative solutions in the meanwhile?
Do you think weak passwords are too dangerous overall (many other ways of attacking them outside of direct
protocol attempts that we try to defend against), and so we shouldn't entertain them at all?
Tnx!
Regards,
Uri
----- Original Message -----
From: pgut001 <pgut001 <at> wintermute02.cs.auckland.ac.nz>
To: smb <at> cs.columbia.edu <smb <at> cs.columbia.edu>; Blumenthal, Uri - 0662 - MITLL
Cc: cfrg <at> irtf.org <cfrg <at> irtf.org>; Hannes.Tschofenig <at> gmx.net <Hannes.Tschofenig <at> gmx.net>;
ipsec <at> ietf.org <ipsec <at> ietf.org>; paul.hoffman <at> vpnc.org <paul.hoffman <at> vpnc.org>
Sent: Tue Mar 02 19:41:43 2010
Subject: Re: [Cfrg] [IPsec] Beginning discussion on secure password-only authentication for IKEv2
"Steven M. Bellovin" <smb <at> cs.columbia.edu> writes:
>Note that the EKE patent expires in October 2011. (At least I think it does;
>it was filed in October 1991.) Depending on when you expect implementations
>to appear-- and given how long it takes to produce standards-track documents
>in the IETF -- it might not be a problem.
Given that SRP implementations have been available and more or less freely
usable for quite some time and TLS-PSK is completely unencumbered anyway, I
think the real issue won't be "when will implementations appear" but "why
RSS Feed