Subject: [secdir] Secdir review of draft-ietf-karp-crypto-key-table-08.txt

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Wed, 7 Aug 2013 13:52:24 +0000

Hi,

After having reviewed version 07, I have only one (minor) nit for version 8, you write:

KDF: A key
       derivation function is a one-way function that provides
       cryptographic separation of key material.  The KDF MAY use
       inputs from the row in the key table and the message being sent
       or received but MUST NOT depend on other configuration state.

I wonder whether that definition is correct. I have always considered forwarding secrecy a desirable but not necessary property for KDF's. For example the key may not have the necessary properties so a transformation may be needed (could be as simple as padding until a certain length). But if you can point me to a definition that includes one-way I stand corrected.

Klaas

---

From: Russ Housley <[email-masked]>
Date: Wed, 7 Aug 2013 10:19:28 -0400

Klaas:

The property you describe depends on the inputs to the KDF, not just the definition of the function.

Notice that an IANA registry is defined, and each entry should point to a definition of the function.

Russ

On Aug 7, 2013, at 9:52 AM, Klaas Wierenga (kwiereng) wrote:

> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

---

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Aug 2013 11:58:28 -0400

>>>>> "Russ" == Russ Housley <[email-masked]> writes:

    Russ> Klaas: The property you describe depends on the inputs to the
    Russ> KDF, not just the definition of the function.

    Russ> Notice that an IANA registry is defined, and each entry should
    Russ> point to a definition of the function.

So, there are a couple of things.
There are functions that take a random bit string and convert them into
a key.  For example if you have 56 random bits and want a 64-bit
correct-parity DES key.

I don't have  a good name for such a function but it's not a KDF.

There are functions that take the output of key agreement (DH, ECDH,
etc) and convernt into a good symmetric key.  I've heard those described
as key expansion functions or KDFs.

There are functions that take one symmetric key and turn it into another
symmetric key so that you can construct a key hierarchy.  I've also seen
these described as KDFs.  It's probable that any function that's really
good at taking key agreement output as input and producing a strong key
will also be good enough  for establishing a key hierarchy.

I'm not aware of definitive definitions in this space, and I'm fairly
sure the text we added in 08 is what we mean for this document.

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Fri, 9 Aug 2013 08:48:34 +0000

Russ, Sam,

> sure the text we added in 08 is what we mean for this document.

OK, I don't argue that this is what you need at all, so no argument there. The only question I raised is whether one-way is a necessary condition for each and every KDF. I would argue that key stretching not necessarily means one-way .

If you add "in this document" somewhere in the definition I'd be happy, if you don't, no big deal either.

Klaas

---

From: Uri Blumenthal <[email-masked]>
Date: Fri, 9 Aug 2013 08:28:39 -0400

IMHO, yes - a KDF must be one-way. Including "key-stretcher" functions.

TNX!

Sent from my iPad

---

From: Uri Blumenthal <[email-masked]>
Date: Fri, 9 Aug 2013 08:36:38 -0400

I would add that a function that "merely" adds parity to a DES key is a singularly bad example, which is long gone and does not need to be resurrected.

TNX!

Sent from my iPad