Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

[John Wilkinson <wilkjohn at gmail.com>]

On Oct 29, 2005, at 10:06 AM, Jack Lloyd wrote:

> On Sat, Oct 29, 2005 at 09:08:42AM -0400, John Wilkinson wrote:
>
> > On Oct 28, 2005, at 6:15 PM, D. J. Bernstein wrote:
> >
> > > You can turn AES into a hash function by applying, e.g., Luby- 
> > > Rackoff
> > > plus Miyaguchi-Preneel. Using this hash function to derive keys is
> > > then
> > > identical to using AES to derive keys.
> >
> > Dr. Bernstein, could you please describe (or give reference to) a way
> > to produce a hash function H from AES, such that HMAC-H is a provably
> > secure PRF, based only on the assumption that AES is a secure PRP?
> > Thanks. -John
>
> The paper "Black-Box Anylsis of the Block-Cipher-Based Hash-Function
> Constructions from PGV" from Crypto '02 (by Black, Rogaway, Shrimpton)
> would seem to get us there. If AES is an ideal cipher, then we know
> the collision and inversion resistance properties of various AES-based
> hashing schemes thanks to that paper.

That AES is an ideal cipher is a much bigger assumption than that AES  
is a secure PRP. Dr. Bernstein stated that there is a way to make a  
hash function from AES such that deriving keys using that hash  
function is "identical" to deriving keys using, say, CMAC-AES. I am  
curious as to what method he has in mind. -John


_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg