Subject: [Cfrg] Revive of draft-agl-ckdf?

From: Joachim Strömbergson <[email-masked]>
Date: Thu, 02 Nov 2017 11:06:41 +0100

Aloha!

draft-agl-ckdf is a draft by Adam Langley specifying a block cipher
based version of the hash based HKDF in RFC 5869. More specifically,
CKDF use AES in CMAC mode to implement the extract and expand stages of
HKDF.

The 01-draft expired Feb 25, 2016. I've had a brief contact with Langley
who stated that he had no further interest in it.

But I think the premise in the introduction of the draft still stands.

For many IoT devices with really constrained MCUs, if there is
cryptographic support in HW, it is an AES-128 core. CKDF would allow
these devices to use the same core for key derivation and session
protection.

In pure SW solutions, having just one primitive makes the code size
smaller too. Performance-wise. the number of iterations and thus total
cycles will be much smaller for CKDF compared to HKDF, reducing the time
to establish sessions.

For these reasons, I believe CKDF would provide use case advantages
compared to HKDF.

Would it be possible to revive the draft?

BR
Joachim Strömbergson

---

From: Joachim Strömbergson <[email-masked]>
Date: Thu, 02 Nov 2017 11:15:05 +0100

Aloha!

Relevant links that I (of course) forgot.

https://www.ietf.org/archive/id/draft-agl-ckdf-01.txt
https://tools.ietf.org/html/rfc5869

BR
JoachimS

Joachim Strömbergson wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Thu, 2 Nov 2017 13:17:58 +0300

Dear Joachim,

Maybe it would be useful to draw your attention to the
https://datatracker.ietf.org/doc/draft-irtf-cfrg-re-keying/  I-D, which
employs HKDF for external re-keying based on hash and a construction based
on Mihir Bellare's paper for external re-keying based on block cipher. Do
you think it will be reasonable to use CKDF instead of that construction?

Best regards,

Stanislav Smyshlyaev, Ph.D.

Head of Information Security Department,
CryptoPro LLC