Re: [Cfrg] existing KDFs and their uses

[David McGrew <mcgrew at cisco.com>]

Hi Peter,

On Oct 21, 2009, at 10:51 PM, Peter Gutmann wrote:

> David McGrew <mcgrew at cisco.com> writes:
>
> > Uses:
>
> There's also a fifth use which I don't think is covered by any of  
> the other
> four, generate multiple sets of cryptovariables (keys, IVs, nonces  
> whatever)
> from a single block of something-or-other (key + nonce + other odds  
> and ends),
> which is what SSL/TLS and SSH do.

I was counting that as "generating one key from another"; this is the  
easy case cryptographically speaking, where we start with a  
(uniformly) random key.

> > S/MIME DH KDF.  Section 2.1.2 of RFC 2631.  (Hash function.)  (Is  
> > this really
> > the most up-to-date reference for SMIME DH?)
>
> Yes.  X9.42 was chosen for political reasons over RSA, so the spec  
> stipulated
> MUST X9.42, MAY RSA.  Implementors everywhere interpreted it as MUST  
> RSA,
> SHOULD NOT X9.42, and after awhile the spec stopped trying to  
> pretend it was a
> MUST as well, and then was allowed to fade into obscurity.
>
> > PBKDF2 (HMAC iterated, with all of the iterates XORed together.) from
> > RFC2898, PKCS #5: Password-Based Cryptography Specification Version  
> > 2.0.
> > Use #4.
>
> It's really all of them, since an iterated KDF is also a standard  
> KDF when
> iterations = 1.

I guess that I should be careful to distinguish between what a  
function is designed for and what it is used for.  Is PBKDF2 used with  
anything other than passwords as its "secret" input?

> > Additions and corrections are welcome.
>
> There's also the PKCS #12 PRF and the OpenPGP PRF.

Ah, I'd forgotten those.

> How obscure can the protocols get?  There's others I know of in  
> little-used or
> application-specific standards that probably don't carry much  
> weight, does
> anyone really care what (say) the CMP PRF looks like?

If it is specified for use on the Internet, and is actually used, it's  
worth cataloging.

thanks,

David

> > Also, pointers to security analyses would be good to have, wherever  
> > they
> > exist.
>
> Security analyses?  Do we do those?
>
> (The only ones I know of are for PBKDF2 and HKDF, although I haven't  
> looked at
> every available document on the PRFs.  For most that I've seen it's  
> just
> security by executive fiat).
>
> Peter.

Attachment: smime.p7s
Description: S/MIME cryptographic signature