Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

["D. J. Bernstein" <djb at cr.yp.to>]

David Wagner writes:
> Dan Bernstein writes:
> > You can turn AES into a hash function by applying, e.g., Luby-Rackoff
> > plus Miyaguchi-Preneel. Using this hash function to derive keys is then
> > identical to using AES to derive keys.
> Is it?  I don't see it.  AES-OMAC(K,X) is provably secure (as a PRF) assuming

Irrelevant. I said nothing about PRFs. I said that using a particular
hash function to derive keys is exactly the same as using AES to derive
keys. Rejecting the hash-based key-derivation function, but accepting
the identical AES-based key-derivation function, is blatantly idiotic.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg