Subject: Re: [Cfrg] WG last call on latest OCB draft.

From: Peter Gutmann <[email-masked]>
Date: Wed, 12 Jun 2013 20:35:25 +0000

David Jacobson <[email-masked]> writes:

>And just an only semi-relevant little point:  The key derivation functions in
>SP 800-108 all include the number of output bits in the computation.  So if
>you use exactly the same key, label, and context, and generate a 128 bit key
>and a 256 bit key, the two keys are completely different.  They could have
>not done that and instead made the argument that people should know better
>than to... .  I think that mixing the output length into the computation of
>both KDFs and authentication tags is good.

I don't know about SP 800-108, but for PBKDF2 there was a strong argument from
one of the contributors that the same input used to produce different-width
outputs should produce completely different output, so an attacker couldn't
leapfrog from one key size (e.g. 40 bits) to another (DES' 56 bits).  So
PBKDF2 includes a specific design feature to avoid this problem (in the
context of when it was created rather than today's variable-width MAC tags).

Peter.