Re: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

[John Wilkinson <wilkjohn at gmail.com>]

On Oct 30, 2005, at 1:42 AM, David Wagner wrote:
> I think the NIST KDF is sub-optimal, and could be improved.

I have never implemented a KDF similar to NIST's proposal; I have  
always used (without really thinking about why) a "pre-hash" of the  
shared secret value H(SV) as the key input to a PRF.

Since I tend to be conservative, I would probably be more inclined to  
use the HKDF proposal if it were like the (already suggested)  
construction:

H_i = HMAC( H(SV), i || contextID )

I thought that some were objecting to this construction on  
implementation difficulty or efficiency grounds, and since I couldn't  
really see anything quantifiably *wrong* with the NIST proposal, I  
suggested leaving the NIST proposal as is. If, however, everyone is  
happy with the above "pre-hash and HMAC" construction, it would  
certainly get my vote.

-John


_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg