Re: Use of AES as prf in IKEv2

[Charlie_Kaufman@notesdev.ibm.com]

Having seen the alternatives, I withdraw my earlier objection to Hugo's
proposal for dealing with prf functions with fixed length keys. His
recommendation was that if the prf takes a fixed length key, we take the
first bits of the initiator's nonce as the first half and the first bits of
the responder's nonce as the second half. Not part of his suggestion, but
to make the proposal fully specified in all cases, I'd add that if either
nonce is shorter than half the fixed length key that it be padded with zero
bits.

Does anyone object?

          --Charlie

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).