Re: KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]

[John Wilkinson <wilkjohn at gmail.com>]

On Oct 29, 2005, at 12:55 PM, David Wagner wrote:
> If the protocol calls for Alice to pick the hash H first and publish
> it, and Mallory later picks the message A, then there is no reason to
> think that H,A will be independent.  Consequently, for such a  
> protocol,
> the Leftover Hash Lemma will not be applicable.

Since the original scenario was DH key exchange, let Alice and Bob be  
the legitimate parties to the communication, and let A = g^xy, where  
x and y are uniform random values chosen by Alice and Bob. Let H be  
chosen in advance by the protocol designer, and made public. How does  
Mallory, a would-be eavesdropper, influence the selection of x and y  
so as to choose A dependent on H? If Mallory has this level of  
influence over Alice and/or Bob, it seems that he would have other  
ways to eavesdrop. So, I'm not sure I see the problem of using the  
leftover hash lemma in the context of entropy extraction for key  
exchange. Any thoughts? -John

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg