Subject: Key derivation for SRP

From: Robert Moskowitz <[email-masked]>
Date: Thu, 01 Nov 2001 13:51:23 -0500

Section 3.1 in RFC 2945 presents a KEYMAT derivation method that is new to me.

I have discussed this with a couple people in the crypto community and I 
have not found anyone that says this is a GOOD method and has any value 
over more common methods like that used in IKE or ANSI 9.42.

the NIST Key Management Workshop ( that I am attending right now) has a 
modified 9.42 key derivation algortihm (see 
http://csrc.nist.gov/encryption/kms/workshop2-page.html and the "key 
establishment schemes document" tag, sec 6.3).  Basically it is interate:

Hash(sharedkey||counter||U||V||[Sharedinfo])

IKE does HMAC and in iteration 2 - N feeds the prior hash in instead of 
sharedkey.

Both of these methods have considerable text on their use.

Is there similar for the key interleave?

I would recommend we specify a key derivation method more consistant with 
recognized methods.