Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

["D. J. Bernstein" <djb at cr.yp.to>]

David Wagner writes:
> So, I don't know what you mean by "exactly the same"

I mean that the functions are equal: same output for every input. I'm
talking about _one_ key-derivation function that can be described in two
equivalent ways:

   * a very simple application of a particular ``hash function'' or
   * a complicated multi-layer Canetti-style application of a particular
     ``cipher,'' namely AES.

This disproves the religious notion that Canetti-style key-derivation
functions are safe while hash-based key-derivation functions are not.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg