Subject: RE: [TLS] PRF in TLS 1.2

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 28 Sep 2006 19:30:40 -0400

><http://www.di.ens.fr/~pointche/Documents/Papers/2006_icalp.pdf>

I'm getting "server not found".

> In this paper we introduce very simple deterministic randomness
> extractors for Diffie-Hellman distributions. More specifically we
> show that the k most significant bits or the k least significant bits
> of a random element in a subgroup of Z*_p are indistinguishable from
> a random bit-string of the same length. This allows us to show that
> under the Decisional Diffie-Hellman assumption we can..........
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
No need to continue - as this assumption has been challenged, and for
practical purposes rejected. That is why TLS, IPsec etc. build such an
elaborate KDF instead of just parceling DH-computed key and running
various PRF from those parts.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Fri, 29 Sep 2006 10:04:35 +0200

> I'm getting "server not found".

You should try again, the URL is correct, you must have encountered a
temporary problem.

> various PRF from those parts.

I wouldn't consider the DDH "rejected", but anyway, this does not
matter.  What the paper proves is that, under certain conditions that
the abstract is silent about but which can be found in the paper, the
k LSB bits or even the k MSB bits of a Diffie-Hellman distribution
have a small statistical distance from the uniform distribution.
"Diffie-Hellman distribution" here merely means a uniform random
element of the subgroup that you're working with.  This is a very
strong result, and the DDH assumption only has to be invoked to
conclude that this means you can *directly* use those LSBs or MSBs as
a key exchange result without having to worry about a KDF.

(One of the conditions for the case of MSB bits in the paper is that
the modulus p needs to be close to a power of 2.  It is obvious that
you need this condition to get a result as strong as this: If the MSBs
of p are 11000000..., say, then the MSB of uniformly random integers
between 0 and p would be 0 with probability 2/3 and 1 with probability
1/3.  This doesn't mean that such parameters are problematic in
practice if you use a hash instead of simple truncation, though.)