Re: [Cfrg] AES-based PRF - comment please

[Uri Blumenthal <uri@bell-labs.com>]

David Wagner wrote:
> > It looks that whatever arguments can be made against this construction,
> > the very same ones apply to the existing PRF's, such as HMAC - 
> I don't see it. 
Let's see. (no pun intended :-)

> In the random oracle model (where SHA1 is modelled as
> a random oracle), I think SHA1-HMAC is golden.
SHA was designed as a collision-resistant hash function. All
the other properties are assumed.

> I'm happier modelling SHA1 as a random oracle than I am modelling
> AES as an ideal cipher.

Why? AES is a lot closer to an ideal cipher (unless and until broken)
than SHA - to random oracle (because if proven wrong, SHA still can
function as a crypto-hash).

> The former has been better studied by cryptanalysts, I think.

For longer time - yes. Better? I doubt. Anyway, this is
highly subjective.


> I think some kind of random oracle or ideal cipher model is going to be
> necessary, if we can't assume our key material is uniformly distributed
> (as seems to be the case for IPSec).
Probably so. So please do join the analysis, will you? After all,
it is for the benefit of everybody involved to get it right. BTW,
what assumptions can be made of g^xy, in your opinion?

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg