Subject: [Cfrg] Re: Cfrg Digest, Vol 23, Issue 2

From: [email-masked]
Date: Tue, 18 Jul 2006 19:49:06 -0400

Dear all,

When you use a Hash-based key derivation function to derive secret keying 
material if the output of the hash function is  not enough for your keying 
material need, then you can repeat the hash function in some mode to derive 
more keying material. More information on this stuff can be found in Hash-
based key derivation internet draft and in SP 800-56A. And, SHA2s are 
encouraged to be used.

quynh

Quoting [email-masked]:

> Send Cfrg mailing list submissions to
> 	[email-masked]
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://www1.ietf.org/mailman/listinfo/cfrg
> or, via email, send a message with subject or body 'help' to
> 	[email-masked]
> 
> You can reach the person managing the list at
> 	[email-masked]
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Cfrg digest..."
> 
> 
> Today's Topics:
> 
>    1. 	Derivation of an AES key from hash function (SHA-1, 256,
>       512) (ngaga Gisse)
>    2. 	Derivation of an AES key from hash function (SHA-1, 256,
>       512) (ngaga Gisse)
>    3. Re: Derivation of an AES key from hash function (SHA-1, 256,
>       512) (Hal Finney)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Mon, 17 Jul 2006 09:21:46 -0700 (PDT)
> From: ngaga Gisse <[email-masked]>
> Subject: [Cfrg] 	Derivation of an AES key from hash function (SHA-1,
> 	256, 512)
> To: [email-masked]
> Cc: ngaga Gisse <[email-masked]>
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Dear Sir,
>   I have the following problem:
>   I propose to use the hash function output as an input to the AES
> algorithm.
>   The output of the AES is used to encrypt message M. 
>    
>   Question:
>   1) I want to use a hash output (e.g. 160 bits stream) as an input to the
> the AES algorithm  1) I want to use a hash output. What techniques should be
> used to match the hash ouput and the AES input ?,  Or what actually should be
> done?
>   2) Question1, but Hash(160 bits) ouput  less than the AES (192 bits) input.
> 
>   3) Are there any known functions that can solve the problem? 
>    
>   Kind regards,
>   Ngaga
> 
>  __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060717/3063f315/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 2
> Date: Mon, 17 Jul 2006 09:23:20 -0700 (PDT)
> From: ngaga Gisse <[email-masked]>
> Subject: [Cfrg] 	Derivation of an AES key from hash function (SHA-1,
> 	256, 512)
> To: [email-masked]
> Cc: ngaga Gisse <[email-masked]>
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Dear Sir,
>   I have the following problem:
>   I propose to use the hash function output as an input to the AES
> algorithm.
>   The output of the AES is used to encrypt message M. 
>    
>   Question:
>   1) I want to use a hash output (e.g. 160 bits stream) as an input to the
> the AES algorithm  1) I want to use a hash output. What techniques should be
> used to match the hash ouput and the AES input ?,  Or what actually should be
> done?
>   2) Question1, but Hash(160 bits) ouput  less than the AES (192 bits) input.
> 
>   3) Are there any known functions that can solve the problem? 
>    
>   Kind regards,
>   Ngaga
> 
>  				
> ---------------------------------
> Want to be your own boss? Learn how on  Yahoo! Small Business. 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060717/c0fb773e/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 3
> Date: Mon, 17 Jul 2006 10:00:02 -0700
> From: "Hal Finney" <[email-masked]>
> Subject: Re: [Cfrg] Derivation of an AES key from hash function
> 	(SHA-1, 256,	512)
> To: "ngaga Gisse" <[email-masked]>
> Cc: [email-masked]
> Message-ID:
> 	<[email-masked]>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> 
> Here's what I would suggest.
> 
> 1. If the hash function output is the same size as the AES key, use it
> directly.
> 
> 2. If the hash function output is bigger than the AES key, use a
> subset of bits of the hash function, for example the leftmost bits.
> 
> 3. If the hash function output is smaller than the AES key, get a
> bigger hash function. There are several 256-bit hash functions in use
> that will be big enough for the largest AES key. Probably the best
> known is SHA-256.
> 
> Hal Finney
> 
> 
> 
> ------------------------------
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 
> 
> End of Cfrg Digest, Vol 23, Issue 2
> ***********************************
> 

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Hal Finney" <[email-masked]>
Date: Tue, 18 Jul 2006 23:51:47 -0700

> based key derivation internet draft and in SP 800-56A. And, SHA2s are

This is true; however if you are interested specifically in collision
resistance, John Kelsey of NIST has an argument that truncating the
output of hash functions does not necessarily preserve this property:

http://www.mail-archive.com/[email-masked]/msg04468.html

That is, even if you knew that a certain 256-bit function were
collision-resistant, it would not follow that its left 128 bits would
be collision resistant.

However, cryptographic hash functions need more properties than
collision-resistance. If your hash function produces left substrings
that are non-random or otherwise flawed for use as cryptographic keys,
then it's not a good hash function. You would not want to use even its
full-width output because this vulnerability in its left bits would
mean that it was not generating full-entropy keys.

We used to tell a riddle like this when I was a boy:

Q. What time is it when your hash function generates non-random left substrings?
A. Time to get a new hash function.

Hal Finney