From nobody Tue Dec 8 06:33:55 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9D263A0FBB for ; Tue, 8 Dec 2020 06:33:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=samwhited.com header.b=nyIguEES; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=ZGkqFmnR Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qqxk0iiGwY2T for ; Tue, 8 Dec 2020 06:33:45 -0800 (PST) Received: from wout4-smtp.messagingengine.com (wout4-smtp.messagingengine.com [64.147.123.20]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7224B3A0FC3 for ; Tue, 8 Dec 2020 06:33:45 -0800 (PST) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.west.internal (Postfix) with ESMTP id BAA23B0E for ; Tue, 8 Dec 2020 09:33:44 -0500 (EST) Received: from imap34 ([10.202.2.84]) by compute4.internal (MEProxy); Tue, 08 Dec 2020 09:33:44 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samwhited.com; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm1; bh=c9YvE vs0aUOvuKK+0rOxehoUOiaYYNMQyViQPxIeoMI=; b=nyIguEESw5PuhqFk558ID BklhOiEiXVM0Hccv5tCzWmX1wCt74kP0Ab3OBA8IilTsVkbsQ0b2/5sbpcyvP4Sr tUiQLnaXSY9tS8En4d0aSHw7TAvYndH5R8Bn0UO/w7u5TRWxykeT2T5GD5OtHcmU RDN3lxUOTlNOoa8W5sQqAgpbZGw1lmdtlZzSCWJr1ZwNNsQEkCvlbdncvqcAF1LF XM/V5dUZ/3sbEGU60cLGnb+N64fVwgMKs6CI/w+nF7Gq92oskSv4W5i6YhJ+1mLt WI/8LIWJdglNa6ntNeccwbgcBFFPxaDkXXisSI/kF8cWrFcU0xz8S1dB0bcnBfg8 Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=c9YvEvs0aUOvuKK+0rOxehoUOiaYYNMQyViQPxIeo MI=; b=ZGkqFmnRIPwvy1YKGpwwfw4Z5BWzX+4BwvumVrFHeomHPvvig6yoxZlmR bUw4IU1yAJKugbI60SUEm4bRCpoZ9A9v2tY6uZwh+AtWOEw10tkBW4RnUphh6FDg NjmrfudeLSslpfO4+G4Df0TMp6DbMk7z+PTdbCUbOan/2bvZpPp8C68VFAUogjyr KbTBmej/bKcyPf7C6wu8Z8T1HzNa3rPYN4/69A5XwqKX4x0EzkRxlCc5nXjPD0ZQ m63iUj2LoGMeDlDLP6jaNK4gqlP4z1UNuUHRi2JTuQUzKHHsFKgJsJ3peNfyrdjl yodXxWj82w3Ohv+o7Hs1LiERy4wbg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrudejiedgieeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgfgsehtqhertderreejnecuhfhrohhmpedfufgr mhcuhghhihhtvggufdcuoehsrghmsehsrghmfihhihhtvggurdgtohhmqeenucggtffrrg htthgvrhhnpedvffeuvdduhfefvdeiheeukeffhfekjeevgffggedtlefhhffhieevkedu vefhjeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hsrghmsehsrghmfihhihhtvggurdgtohhm X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id F06784005C; Tue, 8 Dec 2020 09:33:44 -0500 (EST) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-622-g4a97c0b-fm-20201115.001-g4a97c0b3 Mime-Version: 1.0 Message-Id: In-Reply-To: <853962335.300533.1606173765880@email.ionos.com> References: <383104680.145048.1606106813679@email.ionos.com> <853962335.300533.1606173765880@email.ionos.com> Date: Tue, 08 Dec 2020 14:33:22 +0000 From: "Sam Whited" To: "KITTEN Working Group" Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [kitten] Comments on draft-ietf-kitten-password-storage-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 14:33:54 -0000 I was just re-reading parts of the argon2 I-D and its variable length hash function uses the first 32bytes of the inner hash function, so minimum 32 seems like a reasonable number. Just throwing that out in case anyone wants to disagree or explain to me why I'm misreading the argon2 I-D (which is quite likely). =E2=80=94Sam On Mon, Nov 23, 2020, at 23:22, steve@tobtu.com wrote: > Hmm I guess just pick one as it doesn't really matter. Yeah I suggest > for Argon2 and scrypt to say "default or 24 bytes" and PBKDF2 > "min(hLen, 24 bytes)". You can change 24 to whatever I won't bike shed= > you on that. I like 24 bytes as it's multiple of 3 which is nice with > base 64 encoding. Which is kind of a dumb reason but I will back any > number bytes 16 to 32. --=20 Sam Whited From nobody Tue Dec 8 09:40:26 2020 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D09843A1058; Tue, 8 Dec 2020 09:40:24 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: kitten-chairs@ietf.org, rharwood@redhat.com, kaduk@mit.edu, kitten@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.23.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160744922425.15591.8200735690084142749@ietfa.amsl.com> Date: Tue, 08 Dec 2020 09:40:24 -0800 Archived-At: Subject: [kitten] kitten - Not having a session at IETF 110 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 17:40:25 -0000 Robbie Harwood, a chair of the kitten working group, indicated that the kitten working group does not plan to hold a session at IETF 110. This message was generated and sent by the IETF Meeting Session Request Tool. From nobody Tue Dec 8 10:10:39 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 065E63A1080 for ; Tue, 8 Dec 2020 10:10:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bluepopcorn.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dIl7mT5OnFNb for ; Tue, 8 Dec 2020 10:10:36 -0800 (PST) Received: from v2.bluepopcorn.net (v2.bluepopcorn.net [IPv6:2607:f2f8:a994::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A688C3A107D for ; Tue, 8 Dec 2020 10:10:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bluepopcorn.net; s=supersize; h=Content-Transfer-Encoding:Content-Type: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=RHMvLDKzyp5jPEGk+FikriTW4B1ZA77U2DcbQgXgB0E=; b=uJCP7AWDWRsWHXmqdbJIfzrhW6 wQLD18rjrMi6vYu4XSYznE2AbiEPICaxg/o/WOOasOi0YAG2YBKVrc0kBWd3bM1zi9bgJP9mwrTij eSA98RctxuD9YfYSMqAX450W54ZoOxgdLz2bEmH8pplZVhvKTJGi1hMC+m1lbaEoTf8U=; Received: from [2601:647:4400:1261:9511:8ebf:831d:3a40] (helo=[10.10.20.144]) by v2.bluepopcorn.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kmhRa-0001UV-PT; Tue, 08 Dec 2020 10:10:34 -0800 From: "Jim Fenton" To: "Sam Whited" Cc: "KITTEN Working Group" Date: Tue, 08 Dec 2020 10:10:34 -0800 X-Mailer: MailMate (1.13.2r5673) Message-ID: In-Reply-To: References: <383104680.145048.1606106813679@email.ionos.com> <853962335.300533.1606173765880@email.ionos.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [kitten] Comments on draft-ietf-kitten-password-storage-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 18:10:38 -0000 On 8 Dec 2020, at 6:33, Sam Whited wrote: > I was just re-reading parts of the argon2 I-D and its variable length > hash function uses the first 32bytes of the inner hash function, so > minimum 32 seems like a reasonable number. Just throwing that out in > case anyone wants to disagree or explain to me why I'm misreading the > argon2 I-D (which is quite likely). Somewhat ignoring the details of argon2, an ideal hash function would have no attack that is more efficient than taking random guesses of the input and comparing the output. NIST SP 800-131A considers (in the context of choosing key sizes) a minimum of 112 bits to be sufficiently free from brute-force attacks. I’d suggest that this not be larger than it needs to be. I won’t quibble over the difference between 112 bits and 128 bits, but twice that seems a bit excessive as a lower bound, unless argon2 is a lot further from ideal than I expect. -Jim From nobody Tue Dec 8 14:25:06 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D1253A1274 for ; Tue, 8 Dec 2020 14:25:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2QvY7BeVUTNU for ; Tue, 8 Dec 2020 14:25:03 -0800 (PST) Received: from mout.perfora.net (mout.perfora.net [74.208.4.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B17C3A1275 for ; Tue, 8 Dec 2020 14:25:03 -0800 (PST) Received: from oxuslxaltgw15.schlund.de ([10.72.76.71]) by mrelay.perfora.net (mreueus002 [74.208.5.2]) with ESMTPSA (Nemesis) id 0Lj04u-1k9ZJI16Z4-00dEUq for ; Tue, 08 Dec 2020 23:25:02 +0100 Date: Tue, 8 Dec 2020 16:25:01 -0600 (CST) From: steve@tobtu.com To: "kitten@ietf.org" Message-ID: <2005185486.89135.1607466301960@email.ionos.com> In-Reply-To: References: <383104680.145048.1606106813679@email.ionos.com> <853962335.300533.1606173765880@email.ionos.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev28 X-Originating-Client: open-xchange-appsuite X-Provags-ID: V03:K1:3uxJhWveGWBxD9/TJZOBUddAMPILv+QgQgrnfZersivMmJWN3QH bwQA87Drzkgius5daeQllJlXoa6venFGZNdh5Mr5UsFSB2d9RfOjE1wahD29PARnz1eHQZ6 x/JBX9nTN3Ie3ks8YxCO3Utq8D0UVx45XwPDjg6Qh54sPUNJgSwVnesPDYC16DgvCwnhep8 wmH8/10+8+lwHYi7RpofQ== X-UI-Out-Filterresults: notjunk:1;V03:K0:Z6qtN2XIJ4s=:L0y2TUdr/pHYCrVxyIjmbL Fx4up1KTLOKCQExHpn8pEiVgh7M/sXYjY2st8J3n3W3BykDEAjIFoJcOr86+SX5+rfKPzknsU dJyC9xCX5thATQO2+QXLJOC8bugOfGaKxUCarjm6XxuTez8z9RlB6zyBKODxefQWFj9Vz09hh f70Cnd/UGYcomQld/YczPhdqFJCDNSWHg7dYwyy4ZZ+p9R8GeXOdNxa5STUxGjvPbDSyBYhu6 YwpUjhMUr+RyS8/lQfIkMhfQ/NfBlNT6mlDCI9c5ygEVL8vxp0hASRA0Du9SA7iI0i3mS3l5j m+SNwTq1Xfsto4yPmPzRuh5/mUtVAAxDkS4nI2379DbkCgDkcM6KtxcceT8+pYdgPBGD1UHzM V4Ki+Z+JnhpgpvdmToGbrY+JiokApl2527pQZc8qgJybDVVgWsqQTteLyUf+6wM/3XLNZbWB0 KRdUuEizQkd7r+Tj2w4I6xCHIf4pHJYMKQdtuBPu5XSbZJ/ooMCt Archived-At: Subject: Re: [kitten] Comments on draft-ietf-kitten-password-storage-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 22:25:06 -0000 > On 12/08/2020 8:33 AM Sam Whited wrote: > > > I was just re-reading parts of the argon2 I-D and its variable length > hash function uses the first 32bytes of the inner hash function, so > minimum 32 seems like a reasonable number. Just throwing that out in > case anyone wants to disagree or explain to me why I'm misreading the > argon2 I-D (which is quite likely). > I do not agree with "minimum 32 bytes", but if you state "default or 32 bytes" that's fine. From nobody Tue Dec 8 14:47:06 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F0883A12B8 for ; Tue, 8 Dec 2020 14:47:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cpDMCd03hWiT for ; Tue, 8 Dec 2020 14:47:03 -0800 (PST) Received: from mout.perfora.net (mout.perfora.net [74.208.4.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 020BD3A12B7 for ; Tue, 8 Dec 2020 14:47:02 -0800 (PST) Received: from oxuslxaltgw15.schlund.de ([10.72.76.71]) by mrelay.perfora.net (mreueus004 [74.208.5.2]) with ESMTPSA (Nemesis) id 1M8Pmu-1kiO2v48jg-004SGY for ; Tue, 08 Dec 2020 23:47:02 +0100 Date: Tue, 8 Dec 2020 16:47:01 -0600 (CST) From: steve@tobtu.com To: "kitten@ietf.org" Message-ID: <1733422854.89427.1607467621694@email.ionos.com> In-Reply-To: References: <383104680.145048.1606106813679@email.ionos.com> <853962335.300533.1606173765880@email.ionos.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev28 X-Originating-Client: open-xchange-appsuite X-Provags-ID: V03:K1:YXwhLJY9u8HYth89bCsZ8x0ZMZume1HC6kJ+nluTo3nfKW9IG0U uMd89nCI098ribkuemZUd712IFN5GzJvHVb+8/bw0JtYfe8GXlqOIllD1VhoBXp/MfWkIIK ZxIn3mfPp3iq54bufP98wp73EmBjpVQVQOQAq0djV5Pgo2HF2yoJCVenm/TI6raNXV7iiB/ r999NcwF7RnbBKXa77k8Q== X-UI-Out-Filterresults: notjunk:1;V03:K0:mKGaMg9x728=:i12Du8iGZ8+kDfWkLB0tSc ZmrSoBBGLv0kYy4Er2mhOJmfMeBPPlt0Wx1n2rwy7DB/acVyx8ANc8acxorPqDSaFrZ4P2rM+ 8AWWg8ofm5jx9DLBGT1MBbjdg9BhB8ibTp3wuynGEQ2m0PNkoNi/nNu3XYjobk5oHZuHWgNao K241rCO6IuFL/JJYVn7Z/LV5wzXGsi2Dj8coPjqBd1ZHRQmItdj8OnQg03SM05/61sG7ztWYy Ob+FndVXUY9+ogqQOixmWGpTDwBkTuxS8mGUdoMj/NLRfgxskjNaqf3CAl54OJHflDtHb1pyV s+7o+6QVFYA+mHkN53QM4iv7sIrEBNGgby/mrtAGaXs4EnRIUQYLvxHtI1uqRKHE4sS+Fpi+f QVFsDdzEtrTfZsyEfMr+mu4/K920x9WgQZpFGnjHrvVEzhpJX5BXva+lf/GgB Archived-At: Subject: Re: [kitten] Comments on draft-ietf-kitten-password-storage-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 22:47:05 -0000 > On 12/08/2020 12:10 PM Jim Fenton wrote: >=20 > =20 > On 8 Dec 2020, at 6:33, Sam Whited wrote: >=20 > > I was just re-reading parts of the argon2 I-D and its variable length > > hash function uses the first 32bytes of the inner hash function, so > > minimum 32 seems like a reasonable number. Just throwing that out in > > case anyone wants to disagree or explain to me why I'm misreading the > > argon2 I-D (which is quite likely). >=20 > Somewhat ignoring the details of argon2, an ideal hash function would=20 > have no attack that is more efficient than taking random guesses of the= =20 > input and comparing the output. NIST SP 800-131A considers (in the=20 > context of choosing key sizes) a minimum of 112 bits to be sufficiently= =20 > free from brute-force attacks. >=20 So this made me think, I'm saying 128 bit hash output because brute forcing= "128 bits" is a lot of work. But this is already stretched by 10 to 30 bit= s. So technically "128-log2(amount of work)" bits is what I was thinking of= . It looks like NIST is saying 2^112 amount of work is "sufficiently free f= rom brute-force attacks". Using that the minimum for storing a password has= h* is "112-log2(amount of work)" bits. * Note if this is actually a key used in something like SCRAM or a PAKE whe= re the key can be directly guessed then the minimum is 112 bits. > I=E2=80=99d suggest that this not be larger than it needs to be. I won=E2= =80=99t=20 > quibble over the difference between 112 bits and 128 bits, but twice=20 > that seems a bit excessive as a lower bound, unless argon2 is a lot=20 > further from ideal than I expect. >=20 If NIST says 112 bits is fine then OK. Also for this if the key stretching = is at least 16 bits then it's at 128 bit strength, so eh. Also I have my pa= ssword manager generate ~80 bit strength passwords and I feel that's safe e= nough even if it's an unsalted, fast hash. But one reason I go with a minim= um hash length of 128 bits is to avoid people saying it's too small. As I s= aid before 16 to 32 bytes I won't argue and I guess if you're NIST you can = go down to 14 bytes if you want to. P.S. Argon2 uses Blake2b for the final hash: block =3D zeroBlock foreach lane in lanes { block =3D xorBlocks(block, lane[lastBlock]) } out =3D "" x =3D blake2b(block) while (outlen - len(out) > 64) { out =3D out || substr(x, 0, 32) x =3D blake2b(x) } return substr(out || x, 0, outlen) From nobody Tue Dec 8 18:13:36 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA6B13A0AD8 for ; Tue, 8 Dec 2020 18:13:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6DI9MyElRLVW for ; Tue, 8 Dec 2020 18:13:33 -0800 (PST) Received: from mout.perfora.net (mout.perfora.net [74.208.4.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A92E73A0AD4 for ; Tue, 8 Dec 2020 18:13:33 -0800 (PST) Received: from oxuslxaltgw06.schlund.de ([10.72.76.62]) by mrelay.perfora.net (mreueus004 [74.208.5.2]) with ESMTPSA (Nemesis) id 1MNcUJ-1kTuFz2PbH-00P9cC for ; Wed, 09 Dec 2020 03:13:32 +0100 Date: Tue, 8 Dec 2020 20:13:32 -0600 (CST) From: steve@tobtu.com To: "kitten@ietf.org" Message-ID: <288128249.126529.1607480012238@email.ionos.com> In-Reply-To: <1733422854.89427.1607467621694@email.ionos.com> References: <383104680.145048.1606106813679@email.ionos.com> <853962335.300533.1606173765880@email.ionos.com> <1733422854.89427.1607467621694@email.ionos.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev28 X-Originating-Client: open-xchange-appsuite X-Provags-ID: V03:K1:szPbOIoK4YPz0WPvhlWjMEmD4Aa9WBrq0/QMp+f7Xgm5mglxzQG KJDnwjsHqjLKAL/V+U+E/eIDQNtRd8KxnzYcUp11HFWRtsktLv6aJnZzpyhptbYj7Ej5TWH T1dDsvFnTpas3grlLlle10cg4s+XIzdOvIJr8B8p4jZ9pnT7GZrnaPBWJnebUWxYYwh7VxJ SMmJrY7LyJ8moEU4JBuPg== X-UI-Out-Filterresults: notjunk:1;V03:K0:VHKbyCZhI5E=:UzSUGDrR4oVZPO1fD3dP5N uAjaCsePzKT/FGsIxPZk9yA6ncfJVP2vvDPGgAb17EYOgOQ7gn0ppbVNYeGJ9nFazCGa86Fgw VnetSXdPFGPUfHC+68UOTHN/04PKIzYX7fmN6lZqjxAc3tU0AqSHfS7yfQVHPyWNvyVWJxo9k bGbxjwKtf9iwCLSEgsyCoTqd7CuiMXb9jVZ+pmbpCEitDmlua4F4ZzfV15Vubw3Bb6dmZSYyk omyk3TMKEr/1f0xCQQbVqUWLJZXmsgFXGj0/GcF7nteZcnERVJXG0ZwFVcudZZFmDid3yB/Qg mRbR9mPzxLpmd9aTIDd0xQNZy92+Rx231zlo0c1xGZJLdcb0V2ZEY/SG9K5I5K7qPDxiawOVd QR9qecluiIycXSd0E7OQCRpWkVDUBeS77WlFuuOFT7IJP+GUFkRE+hWf1oPwL Archived-At: Subject: Re: [kitten] Comments on draft-ietf-kitten-password-storage-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 02:13:35 -0000 > On 12/08/2020 4:47 PM steve@tobtu.com wrote: > > P.S. Argon2 uses Blake2b for the final hash: > > block = zeroBlock > foreach lane in lanes > { > block = xorBlocks(block, lane[lastBlock]) > } > out = "" > x = blake2b(block) > while (outlen - len(out) > 64) > { > out = out || substr(x, 0, 32) > x = blake2b(x) > } > return substr(out || x, 0, outlen) > Slight correction I forgot Blake2 uses the output length as an input for hashing. The last hash block is not truncated but of said length. Note Argon2 also uses the output length as an input which is why truncating an Argon2 hash won't match... I forget if I mentioned that. I feel like I did in a draft but removed it as it was too much in the weeds of Argon2. Anyway, even if Argon2 didn't do that, then the use of Blake2b at the end makes it so. Although, if Argon2 didn't use the output length as an input, then you can kind of do truncation compares like "substr(argon2(..., outlen:64 bytes, rawKey:true), 0, 32) == substr(argon2(..., outlen:128 bytes, rawKey:true), 0, 32)" (ie when both outlen are at least 64 bytes and truncated to at most 32 bytes). Anyway the correct Argon2 finalization: x = zeroBlock foreach lane in lanes { x = xorBlocks(x, lane[lastBlock]) } out = "" while (outlen - len(out) > 64) { x = blake2b(x, hashLen:64) out = out || substr(x, 0, 32) } return out || blake2b(x, hashLen:(outlen - len(out)))