[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Cfrg] Can CMAC and/or GMAC be substituted in an HMAC-styled KDF?



I am working on addressing the crypto-agility needs of HIP, and feel that I should go as far as possible. Thus instead of staying locked in to HMAC of the selected hash, I want to allow other MACs, most likely CMAC and GMAC as they are 'NIST approved' (for some case of approved :) ).

So of course there are a couple of uses of HMAC, from MACing within the protocol to the KDF. The NIST documents explain how to use these MACs for their data MACing purpose, but I am hazy on the KDF part, particularly in light of the KDF discussions going on here.

So for my 1st approximation of KDFs based on CMAC or GMAC, can they be directly substituted for HMAC. I think that part of the answer for GMAC will be 'where is the IV'...

The 2nd level becomes a best practice KDF available now (or in the next 2 months) that supports a selection of interchangeable MACs.

Or do we write up the KDF separately for each supported MAC.