Re: Summary of key derivation thread

[Uri Blumenthal <uri@bell-labs.com>]

David Wagner wrote:
> That's not correct.  It is reasonable to view HMAC as a PRF,
> but it is not reasonable to view SHA as a secure PRF.......

Because of single-block vs. multiple-block issues? I.e. you
assume that keyed compresson function of SHA is PRF for
*single block*, and extend it via HMAC to multiple-block
input?

> Again, let me express my opinion that Hugo and Ran are (as usual)
> 100% correct.  They've hit the nail on the head here.

(:-)