Subject: [Cfrg] Re: Cfrg Digest, Vol 23, Issue 3

From: [email-masked]
Date: Tue, 18 Jul 2006 19:40:39 -0400

Dear Ngaga,

I assumed that you meant collision resistance of the hash function and when 
you use a hash function to derive secret keying material, collision resistance 
property of the hash function is not required. If I missed understanding your 
question, then please correct me!

quynh

Quoting [email-masked]:

> Send Cfrg mailing list submissions to
> 	[email-masked]
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://www1.ietf.org/mailman/listinfo/cfrg
> or, via email, send a message with subject or body 'help' to
> 	[email-masked]
> 
> You can reach the person managing the list at
> 	[email-masked]
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Cfrg digest..."
> 
> 
> Today's Topics:
> 
>    1. Re:  Derivation of an AES key from hash function (SHA-1, 256,
>       5 (ngaga Gisse)
>    2. Re: Derivation of an AES key from hash function (SHA-1, 256,
>       512) (ngaga Gisse)
>    3. Re: security of HMAC (Daniel Brown)
>    4. Re: security of HMAC (Scott Fluhrer)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Tue, 18 Jul 2006 10:06:09 -0700 (PDT)
> From: ngaga Gisse <[email-masked]>
> Subject: Re:  [Cfrg] Derivation of an AES key from hash function
> 	(SHA-1, 256, 5
> To: [email-masked]
> Cc: ngaga Gisse <[email-masked]>
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Thank you Finney for the advice.   I have the following question wrt to the
> third advice:
>    
>    How can the  hash collision be guaranteed if only a subset of bits of the
> hash ouput will be used as the AES input? (e.g. the hash ouput is 256 bits,
> and the AES key is 128 bits). 
>    
>   Ngaga
> 
> [email-masked] wrote:      Today's Topics:
> 
> 1. Derivation of an AES key from hash function (SHA-1, 256,
> 512) (ngaga Gisse)
> 2. Derivation of an AES key from hash function (SHA-1, 256,
> 512) (ngaga Gisse)
> 3. Re: Derivation of an AES key from hash function (SHA-1, 256,
> 512) (Hal Finney)
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Mon, 17 Jul 2006 09:21:46 -0700 (PDT)
> From: ngaga Gisse 
> Subject: [Cfrg] Derivation of an AES key from hash function (SHA-1,
> 256, 512)
> To: [email-masked]
> Cc: ngaga Gisse 
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Dear Sir,
> I have the following problem:
> I propose to use the hash function output as an input to the AES algorithm.
> The output of the AES is used to encrypt message M. 
> 
> Question:
> 1) I want to use a hash output (e.g. 160 bits stream) as an input to the the
> AES algorithm 1) I want to use a hash output. What techniques should be used
> to match the hash ouput and the AES input ?, Or what actually should be
> done?
> 2) Question1, but Hash(160 bits) ouput less than the AES (192 bits) input. 
> 3) Are there any known functions that can solve the problem? 
> 
> Kind regards,
> Ngaga
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060717/3063f315/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 2
> Date: Mon, 17 Jul 2006 09:23:20 -0700 (PDT)
> From: ngaga Gisse 
> Subject: [Cfrg] Derivation of an AES key from hash function (SHA-1,
> 256, 512)
> To: [email-masked]
> Cc: ngaga Gisse 
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Dear Sir,
> I have the following problem:
> I propose to use the hash function output as an input to the AES algorithm.
> The output of the AES is used to encrypt message M. 
> 
> Question:
> 1) I want to use a hash output (e.g. 160 bits stream) as an input to the the
> AES algorithm 1) I want to use a hash output. What techniques should be used
> to match the hash ouput and the AES input ?, Or what actually should be
> done?
> 2) Question1, but Hash(160 bits) ouput less than the AES (192 bits) input. 
> 3) Are there any known functions that can solve the problem? 
> 
> Kind regards,
> Ngaga
> 
> 
> ---------------------------------
> Want to be your own boss? Learn how on Yahoo! Small Business. 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060717/c0fb773e/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 3
> Date: Mon, 17 Jul 2006 10:00:02 -0700
> From: "Hal Finney" 
> Subject: Re: [Cfrg] Derivation of an AES key from hash function
> (SHA-1, 256, 512)
> To: "ngaga Gisse" 
> Cc: [email-masked]
> Message-ID:
> 
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> 
> Here's what I would suggest.
> 
> 1. If the hash function output is the same size as the AES key, use it
> directly.
> 
> 2. If the hash function output is bigger than the AES key, use a
> subset of bits of the hash function, for example the leftmost bits.
> 
> 3. If the hash function output is smaller than the AES key, get a
> bigger hash function. There are several 256-bit hash functions in use
> that will be big enough for the largest AES key. Probably the best
> known is SHA-256.
> 
> Hal Finney
> 
> 
> 
> ------------------------------
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 
> 
> End of Cfrg Digest, Vol 23, Issue 2
> ***********************************
> 
> 
> 
>  				
> ---------------------------------
> Want to be your own boss? Learn how on  Yahoo! Small Business. 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060718/6c5fa6bd/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 2
> Date: Tue, 18 Jul 2006 10:10:20 -0700 (PDT)
> From: ngaga Gisse <[email-masked]>
> Subject: Re: [Cfrg] Derivation of an AES key from hash function
> 	(SHA-1, 256,	512)
> To: [email-masked]
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Thank you Finney for the advice.   I have the following question wrt to the
> third advice:
>    
>    How can the  hash collision be guaranteed if only a subset of bits of the
> hash ouput will be used as the AES input? (e.g. the hash ouput is 256 bits,
> and the AES key is 128 bits). 
>    
>   Ngaga
> 
> [email-masked] wrote:
>   Send Cfrg mailing list submissions to
> [email-masked]
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> https://www1.ietf.org/mailman/listinfo/cfrg
> or, via email, send a message with subject or body 'help' to
> [email-masked]
> 
> You can reach the person managing the list at
> [email-masked]
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Cfrg digest..."
> 
> 
> Today's Topics:
> 
> 1. Derivation of an AES key from hash function (SHA-1, 256,
> 512) (ngaga Gisse)
> 2. Derivation of an AES key from hash function (SHA-1, 256,
> 512) (ngaga Gisse)
> 3. Re: Derivation of an AES key from hash function (SHA-1, 256,
> 512) (Hal Finney)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Mon, 17 Jul 2006 09:21:46 -0700 (PDT)
> From: ngaga Gisse 
> Subject: [Cfrg] Derivation of an AES key from hash function (SHA-1,
> 256, 512)
> To: [email-masked]
> Cc: ngaga Gisse 
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Dear Sir,
> I have the following problem:
> I propose to use the hash function output as an input to the AES algorithm.
> The output of the AES is used to encrypt message M. 
> 
> Question:
> 1) I want to use a hash output (e.g. 160 bits stream) as an input to the the
> AES algorithm 1) I want to use a hash output. What techniques should be used
> to match the hash ouput and the AES input ?, Or what actually should be
> done?
> 2) Question1, but Hash(160 bits) ouput less than the AES (192 bits) input. 
> 3) Are there any known functions that can solve the problem? 
> 
> Kind regards,
> Ngaga
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060717/3063f315/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 2
> Date: Mon, 17 Jul 2006 09:23:20 -0700 (PDT)
> From: ngaga Gisse 
> Subject: [Cfrg] Derivation of an AES key from hash function (SHA-1,
> 256, 512)
> To: [email-masked]
> Cc: ngaga Gisse 
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Dear Sir,
> I have the following problem:
> I propose to use the hash function output as an input to the AES algorithm.
> The output of the AES is used to encrypt message M. 
> 
> Question:
> 1) I want to use a hash output (e.g. 160 bits stream) as an input to the the
> AES algorithm 1) I want to use a hash output. What techniques should be used
> to match the hash ouput and the AES input ?, Or what actually should be
> done?
> 2) Question1, but Hash(160 bits) ouput less than the AES (192 bits) input. 
> 3) Are there any known functions that can solve the problem? 
> 
> Kind regards,
> Ngaga
> 
> 
> ---------------------------------
> Want to be your own boss? Learn how on Yahoo! Small Business. 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060717/c0fb773e/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 3
> Date: Mon, 17 Jul 2006 10:00:02 -0700
> From: "Hal Finney" 
> Subject: Re: [Cfrg] Derivation of an AES key from hash function
> (SHA-1, 256, 512)
> To: "ngaga Gisse" 
> Cc: [email-masked]
> Message-ID:
> 
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> 
> Here's what I would suggest.
> 
> 1. If the hash function output is the same size as the AES key, use it
> directly.
> 
> 2. If the hash function output is bigger than the AES key, use a
> subset of bits of the hash function, for example the leftmost bits.
> 
> 3. If the hash function output is smaller than the AES key, get a
> bigger hash function. There are several 256-bit hash functions in use
> that will be big enough for the largest AES key. Probably the best
> known is SHA-256.
> 
> Hal Finney
> 
> 
> 
> ------------------------------
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 
> 
> End of Cfrg Digest, Vol 23, Issue 2
> ***********************************
> 
> 
>  __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060718/12946b27/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 3
> Date: Tue, 18 Jul 2006 18:13:33 -0400
> From: Daniel Brown <[email-masked]>
> Subject: Re: [Cfrg] security of HMAC
> To: "Steven M. Bellovin" <[email-masked]>
> Cc: [email-masked]
> Message-ID:
> 	<OF0B7B47E0.FC85370B-ON852571AF.007938DC-
[email-masked]>
> 	
> Content-Type: text/plain; charset="us-ascii"
> 
> Is it correct that the first paper is claiming to be able forge HMAC-SHA1 
> with work effort 2^53?  If so, should the Cfrg recommend migrating away 
> from HMAC-SHA1 (at least for message authentication) more rapidly, given 
> that most IETF WGs are operating under the advice that the SHA1 attacks 
> are not expected to have any impact on HMAC-SHA1, of which this paper 
> would seem to disabuse.
> 
> Thanks,
> 
> Dan Brown
> (905) 501-3857
> http://www.certicom.com
> 
> "Steven M. Bellovin" <[email-masked]> wrote on 07/10/2006 12:24:40 
> PM:
> 
> > Folks may want to read http://eprint.iacr.org/2006/187 and
> > http://eprint.iacr.org/2006/043 on the security of HMAC.  (My thanks to
> > ekr for sending me those links.)
> > 
> >       --Steven M. Bellovin, http://www.cs.columbia.edu/~smb
> > 
> > _______________________________________________
> > Cfrg mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/cfrg
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> 
http://www1.ietf.org/pipermail/cfrg/attachments/20060718/7b31e688/attachment.ht
ml
> 
> ------------------------------
> 
> Message: 4
> Date: Tue, 18 Jul 2006 15:59:14 -0700 (PDT)
> From: Scott Fluhrer <[email-masked]>
> Subject: Re: [Cfrg] security of HMAC
> To: Daniel Brown <[email-masked]>
> Cc: [email-masked], "Steven M. Bellovin" <[email-masked]>
> Message-ID: <[email-masked]>
> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
> 
> 
> 
> On Tue, 18 Jul 2006, Daniel Brown wrote:
> 
> > Is it correct that the first paper is claiming to be able forge HMAC-SHA1
> > with work effort 2^53?
> 
> No, the results in table 3 claims the 2^53 forgery result applies to a 
> reduced round version of SHA-1 (34 rounds, rather than the full 80).
> 
> This appears to be an impressive result, but it is not a cause to panic.
> 
> >                        If so, should the Cfrg recommend migrating away
> > from HMAC-SHA1 (at least for message authentication) more rapidly, given
> > that most IETF WGs are operating under the advice that the SHA1 attacks
> > are not expected to have any impact on HMAC-SHA1, of which this paper
> > would seem to disabuse.
> >
> > Thanks,
> >
> > Dan Brown
> > (905) 501-3857
> > http://www.certicom.com
> >
> > "Steven M. Bellovin" <[email-masked]> wrote on 07/10/2006 12:24:40
> > PM:
> >
> >> Folks may want to read http://eprint.iacr.org/2006/187 and
> >> http://eprint.iacr.org/2006/043 on the security of HMAC.  (My thanks to
> >> ekr for sending me those links.)
> >>
> >>       --Steven M. Bellovin, http://www.cs.columbia.edu/~smb
> >>
> >> _______________________________________________
> >> Cfrg mailing list
> >> [email-masked]
> >> https://www1.ietf.org/mailman/listinfo/cfrg
> >
> 
> 
> 
> ------------------------------
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 
> 
> End of Cfrg Digest, Vol 23, Issue 3
> ***********************************
> 

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg