Subject: Key lengths for algorithms for variable-length keys

From: Ben Harris <[email-masked]>
Date: Thu, 3 Mar 2005 00:35:37 +0000 (GMT)

transport-23, in section 7.2, says:

    128 bits (16 bytes) MUST be used for algorithms with variable-length
    keys.  The only variable key length algorithm defined in this
    document is arcfour).

Apart from the mismatched parenthesis, this seems like a strange 
pair of sentences.  The "arcfour" algorithm as specified in section 6.3 is 
defined to have a 128-bit key anyway.  RC4 does generally support variable 
key lengths, but so do Blowfish and CAST-128, so why aren't they 
mentioned?

If this stipulation is meant to apply to all future algorithms, it seems 
like a particularly bad idea.  Is it intended to prevent me defining 
"[email-masked]" to be RC4 with a 256-bit key, for instance?  If 
not, what does it do?

-- 
Ben Harris

---

From: [email-masked] (Niels Möller)
Date: 03 Mar 2005 09:09:22 +0100

>     keys.  The only variable key length algorithm defined in this

I agree this is awkward. I'd suggest the paragraph is cut down from

   Key data MUST be taken from the beginning of the hash output.  128
   bits (16 bytes) MUST be used for algorithms with variable-length
   keys.  The only variable key length algorithm defined in this
   document is arcfour).  For other algorithms, as many bytes as are
   needed are taken from the beginning of the hash value. [...]

to

   Key data MUST be taken from the beginning of the hash output.  As
   many bytes as are needed are taken from the beginning of the hash
   value. [...]

For key length, we already have the general recommendation "All ciphers
SHOULD use keys with an effective key length of 128 bits or more." in
6.3. For arcfour in particular, it may be a little confusing that it's
named "arcfour" rather than "arcfour-128", but the description

   The "arcfour" is the Arcfour stream cipher with 128 bit keys.

makes it clear which key length is used. (Small nit: "cipher" should be
inserted like 

   The "arcfour" cipher is the Arcfour stream cipher with 128 bit keys.

)

For improved clarity, one could also add the arcfour keylength to the
table. Before:

     ...
     serpent128-cbc   OPTIONAL          Serpent with 128-bit key
     arcfour          OPTIONAL          the ARCFOUR stream cipher
     idea-cbc         OPTIONAL          IDEA in CBC mode
     ...

After:

     ...
     serpent128-cbc   OPTIONAL          Serpent with 128-bit key
     arcfour          OPTIONAL          the ARCFOUR stream cipher
                                        with 128 bit key
     idea-cbc         OPTIONAL          IDEA in CBC mode
     ...

> If this stipulation is meant to apply to all future algorithms, it
> seems like a particularly bad idea.  Is it intended to prevent me
> defining "[email-masked]" to be RC4 with a 256-bit key, for
> instance?  If not, what does it do?

I agree this doesn't make sense.

Regards,
/Niels

---

From: Chris Lonvick <[email-masked]>
Date: Tue, 8 Mar 2005 11:59:05 -0800 (PST)

Hi,

>    many bytes as are needed are taken from the beginning of the hash

I'll make these changes unless I hear objections.

>    The "arcfour" cipher is the Arcfour stream cipher with 128 bit keys.

OK.

>      idea-cbc         OPTIONAL          IDEA in CBC mode

OK.

I also see that about half of the occurances of bit lengths are of the
form "nnn-bit" and the other half are of the form "nnn bit".  All of the
occurances of byte lengths are of the format of "mmm bytes".  Unless I
hear objections, I'm going to change these to be "nnn bit" and clean up
the syntax a bit.  As in the above, it will be:

Formerly:

Proposed:
      serpent128-cbc   OPTIONAL          Serpent with a 128 bit key

> I agree this doesn't make sense.

Does anything further need to be edited or clarified if the above changes
are made?

Thanks,
Chris

---

From: Ben Harris <[email-masked]>
Date: Thu, 10 Mar 2005 12:39:27 +0000

>I'll make these changes unless I hear objections.

Sounds good to me.

>the syntax a bit.

I don't really care, but: If you want an adjective, you should write
"128-bit"; if you want a noun, write "128 bits".  On this basis, the errors
I can find are:

   one initialization vector).  This is a block cipher with 8 byte
(should be "8-byte")
   The "blowfish-cbc" cipher is Blowfish in CBC mode, with 128 bit keys
(should be "128-bit")
   [SCHNEIER].  This is a block cipher with 8 byte blocks.
(should be "8-byte")
   The "twofish-cbc" or "twofish256-cbc" cipher is Twofish in CBC mode,
   with 256 bit keys as described [TWOFISH].  This is a block cipher
(should be "256-bit")
   with 16 byte blocks.
(should be ("16-byte")
   The "arcfour" is the Arcfour stream cipher with 128 bit keys.  The
(should be "128-bit")
   The value for 'dss_signature_blob' is encoded as a string containing
   r followed by s (which are 160 bits long integers, without lengths or
(should be "160-bit-long integers" or "160-bit integers")
   The "diffie-hellman-group1-sha1" method specifies Diffie-Hellman key
   exchange with SHA-1 as HASH, and Oakley Group 2 [RFC2409] (1024bit
(should be "1024-bit")
   The "diffie-hellman-group14-sha1" method specifies Diffie-Hellman key
   exchange with SHA-1 as HASH, and Oakley Group 14 [RFC3526] (2048bit
(should be "2048-bit")

in [SSH-ARCH]:
   Because MACs use a 32 bit sequence number, they might start to leak
(should be "32-bit")

>Does anything further need to be edited or clarified if the above changes

No.

-- 
Ben Harris