Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

[Jack Lloyd <lloyd at randombit.net>]

On Sat, Oct 29, 2005 at 09:08:42AM -0400, John Wilkinson wrote:
> 
> On Oct 28, 2005, at 6:15 PM, D. J. Bernstein wrote:
> >You can turn AES into a hash function by applying, e.g., Luby-Rackoff
> >plus Miyaguchi-Preneel. Using this hash function to derive keys is  
> >then
> >identical to using AES to derive keys.
> 
> Dr. Bernstein, could you please describe (or give reference to) a way  
> to produce a hash function H from AES, such that HMAC-H is a provably  
> secure PRF, based only on the assumption that AES is a secure PRP?  
> Thanks. -John

The paper "Black-Box Anylsis of the Block-Cipher-Based Hash-Function
Constructions from PGV" from Crypto '02 (by Black, Rogaway, Shrimpton)
would seem to get us there. If AES is an ideal cipher, then we know
the collision and inversion resistance properties of various AES-based
hashing schemes thanks to that paper. At that point we can say how
strong an NMAC scheme instantiated with such a hash would be, and by
making the usual NMAC->HMAC leap of faith, we have a proof (of sorts).

Jack

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg