Re: [Cfrg] Fwd: Can CMAC and/or GMAC be substituted in an HMAC-styledKDF?

["Dan Brown" <dbrown at certicom.com>]

This raises a minor, non-security issue: isn't a KDF a lower level primitive than a MAC?  E.g. the key in a MAC is one of the intended purposes of the output of a KDF, not the other way.   If so, isn't it architecturally awkward to define a KDF that has built-in component of a MAC?  E.g. HKDF has HMAC built-in.

More philosophically, is building new primitives from old primitives, where the old have to do more than their original aim (e.g. HMAC as more than MAC, SHA1 as more than CRHF) the wisest approach?  Does it put too much reliance on these retrofitted primitives?

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.