[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: change in isakmp/oakley
I'd thought you were going to contrast collision resistance with
"mixing" and use that as the rationale for using prf for
authentication, hash for key derivation. And I was going to
reply that we expect that the key for prf will always be at least
128 bits, so the point is moot, because the key always fills the
first input block for the one-way function.
Instead, the worry expressed is that the prf definition will allow key
truncation. I'd never considered that a possibility, though I suppose
that is why correct composition is such a hard problem --- incomplete
specifications of the composition requirements.
Do the spec's allow the prf's to do key truncation? What do they do
with keys longer than one block? My own opinion is that truncation
is a severe bug in any case, and that it should be fixed. This makes
their use for session key derivation moot.
Hilarie
Follow-Ups:
References: