Re: [Cfrg] On using ROs for analyzing randomness extraction functions

[canetti <canetti at watson.ibm.com>]

John,

Again, if I may intervene...

my take here is that, yes, in principle the method you suggest works for
the reasons you stated.

But Dan is right that care should be taken: First, the leftover hash lemma
guarantees almost-randomness of the output only if the output size is much
shorter than the input (and is roughly the size of the underlying
entropy).

Also, there is dependence of the specific key exchange method in use, and
in some cased UH is not enough. an example is the case mentioned by Dan,
where parties use related exponents for different exchanges. other examples
includes, say, exchanges where the peer identities must be incorporated
into the derivation procedure to prevent "identity misbinding attacks".
so, in all, it is probably hard to come up with a generic method that will
provide a good extraction/derivation function for all KE methods,
even if an independent R is given.

however, for "standard" ke methods such as the ISO-9798-3 or IKE, without
reuse of the ephemeral exponents,  universal hashing with sufficiently
short output should work.

Ran



On Mon, 31 Oct 2005, John Wilkinson wrote:

> On Oct 31, 2005, at 1:10 PM, D. J. Bernstein wrote:
>
> > John Wilkinson writes:
> >
> >> 2.3) K_i = PRF( UH( R, SV ), i || context )
> >> 2.3 seems to be the only one that offers security in the standard
> >> model,
> >>
> >
> > You've been misled. That construction does _not_ guarantee secure key
> > derivation under standard assumptions.
>
> OK, clearly I'm in way over my head, but isn't that what the
> discussion about the Leftover Hash Lemma was about? Doesn't that
> lemma guarantee that UH(R,SV) is delta-uniform when R is chosen
> independently of SV? And if the output of UH is delta-uniform, then
> isn't the PRF secure under standard assumptions? I know this falls
> far short of a real proof, but, as I said, I'm in over my head here.
>
> -John
>
>

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg