Subject: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

From: David Wagner <[email-masked]>
Date: Fri, 28 Oct 2005 10:11:18 -0700 (PDT)

Dan Bernstein writes:
>How do we build PRFs? By hashing the key and the input.

That's one possibility, although I'm starting to become inclined to
limit our reliance on hash functions as much as necessary, after all
these attacks on many of our hash functions.  Another possibility --
which I would have more confidence in at the moment -- is to use a block
cipher based PRF such as AES-OMAC.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "D. J. Bernstein" <[email-masked]>
Date: 28 Oct 2005 22:15:39 -0000

David Wagner writes:
> Another possibility -- which I would have more confidence in at the
> moment -- is to use a block cipher based PRF such as AES-OMAC.

You can turn AES into a hash function by applying, e.g., Luby-Rackoff
plus Miyaguchi-Preneel. Using this hash function to derive keys is then
identical to using AES to derive keys.

Or you can use Whirlpool, a more efficient AES-style hash function.
Using Whirlpool to derive keys isn't exactly the same as applying AES,
but it's based on the same design principles.

In other words, there's no justification for the religious notion that
``encryption functions'' are safe while ``hash functions'' are to be
avoided. Sure, MD5 is a disaster, but 4-round AES is a disaster for the
same reasons. If you want to know whether a primitive is safe, you have
to look at the details of the primitive; the high-level packaging is
almost irrelevant.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

---

From: John Wilkinson <[email-masked]>
Date: Sat, 29 Oct 2005 09:08:42 -0400

> identical to using AES to derive keys.

Dr. Bernstein, could you please describe (or give reference to) a way  
to produce a hash function H from AES, such that HMAC-H is a provably  
secure PRF, based only on the assumption that AES is a secure PRP?  
Thanks. -John

---

From: Jack Lloyd <[email-masked]>
Date: Sat, 29 Oct 2005 10:06:49 -0400

> secure PRF, based only on the assumption that AES is a secure PRP?  

The paper "Black-Box Anylsis of the Block-Cipher-Based Hash-Function
Constructions from PGV" from Crypto '02 (by Black, Rogaway, Shrimpton)
would seem to get us there. If AES is an ideal cipher, then we know
the collision and inversion resistance properties of various AES-based
hashing schemes thanks to that paper. At that point we can say how
strong an NMAC scheme instantiated with such a hash would be, and by
making the usual NMAC->HMAC leap of faith, we have a proof (of sorts).

Jack

---

From: John Wilkinson <[email-masked]>
Date: Sat, 29 Oct 2005 11:56:03 -0400

On Oct 29, 2005, at 10:06 AM, Jack Lloyd wrote:

> hashing schemes thanks to that paper.

That AES is an ideal cipher is a much bigger assumption than that AES  
is a secure PRP. Dr. Bernstein stated that there is a way to make a  
hash function from AES such that deriving keys using that hash  
function is "identical" to deriving keys using, say, CMAC-AES. I am  
curious as to what method he has in mind. -John