Subject: [Cfrg] Fwd: Hash-Based Key Derivation (fwd)

From: David Wagner <[email-masked]>
Date: Fri, 28 Oct 2005 15:23:08 -0700 (PDT)

Dan Bernstein writes:
>David Wagner writes:
>> Another possibility -- which I would have more confidence in at the
>> moment -- is to use a block cipher based PRF such as AES-OMAC.
>
>You can turn AES into a hash function by applying, e.g., Luby-Rackoff
>plus Miyaguchi-Preneel. Using this hash function to derive keys is then
>identical to using AES to derive keys.

Is it?  I don't see it.  AES-OMAC(K,X) is provably secure (as a PRF)
assuming only that AES is a secure PRP.  Is your M-P + L-R hash KDF
provably secure under the same assumption?  I don't see why it would be.

In general, the schemes that build a hash function out of a block cipher
generally make much stronger assumptions about the block cipher:

  - In theory, if you want to prove something about such hash modes,
  you generally have to work in the ideal cipher model (the analog to
  the random oracle model); assuming only that the block cipher is a
  secure PRP (the standard model) gets you roughly nowhere.

  - In practice, such hash modes put a lot more stress on the key
  schedule than encryption or PRF modes do.  For instance, there are
  real-world block ciphers that appear to be highly secure when used
  for encryption, MACs, or PRFs, yet are totally insecure when using in
  a standard hashing mode.  TEA is a favorite example along these
  lines.  RMAC is another fantastic example.

>In other words, there's no justification for the religious notion that
>``encryption functions'' are safe while ``hash functions'' are to be
>avoided.

It's not religion.  There is a difference between PRP/PRF assumptions
and ideal cipher/random oracle model "assumptions".

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "D. J. Bernstein" <[email-masked]>
Date: 29 Oct 2005 10:45:13 -0000

David Wagner writes:
> Is it?  I don't see it.  AES-OMAC(K,X) is provably secure (as a PRF) assuming

Irrelevant. I said nothing about PRFs. I said that using a particular
hash function to derive keys is exactly the same as using AES to derive
keys. Rejecting the hash-based key-derivation function, but accepting
the identical AES-based key-derivation function, is blatantly idiotic.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago