[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Cfrg] Can CMAC and/or GMAC be substituted in an HMAC-styled KDF?
I am working on addressing the crypto-agility needs of HIP, and feel
that I should go as far as possible. Thus instead of staying locked in
to HMAC of the selected hash, I want to allow other MACs, most likely
CMAC and GMAC as they are 'NIST approved' (for some case of approved :) ).
So of course there are a couple of uses of HMAC, from MACing within the
protocol to the KDF. The NIST documents explain how to use these MACs
for their data MACing purpose, but I am hazy on the KDF part,
particularly in light of the KDF discussions going on here.
So for my 1st approximation of KDFs based on CMAC or GMAC, can they be
directly substituted for HMAC. I think that part of the answer for GMAC
will be 'where is the IV'...
The 2nd level becomes a best practice KDF available now (or in the next
2 months) that supports a selection of interchangeable MACs.
Or do we write up the KDF separately for each supported MAC.