Subject: [Hipsec] Major change to KEYMAT

From: Robert Moskowitz <[email-masked]>
Date: Tue, 15 Dec 2009 12:14:59 -0500

I am leaning heavily to change the KEYMAT process to using 
http://www.ietf.org/id/draft-krawczyk-hkdf-00.txt

The HITs will be the INFO fed into the Expand step, but there is a 
deficiency in the current KEYMAT WRT the SALT for the Extract phase.

Currently we have I and J used in KEYMAT, but both J is not truly 
sourced from the Initiator, it is influenced by I from the Responder.  
And both are too short by 'accept practices' that each NONCE is twice 
the size of the desired master key.

So there should be a NONCE1 in R1 and NONCE2 in I2.  I think that NONCE1 
SHOULD be echoed back in I2.

The NONCE length is variable, 256, 384, or 512 depending on the key size 
needed?  Which raises the question of where we control key length for 
AES?  We are probably defaulting to 128 and not allowing for larger key 
lengths?

---

From: Miika Komu <[email-masked]>
Date: Mon, 28 Dec 2009 17:05:08 +0100

Robert Moskowitz wrote:

Hi,

> http://www.ietf.org/id/draft-krawczyk-hkdf-00.txt

+1 assuming that this is going to adopted as a network WG official draft?

> SHOULD be echoed back in I2.

There's already echo parameters in the base exchange, so they should be 
just mandatory.

> AES?  We are probably defaulting to 128 and not allowing for larger key 

What about fixing the key sizes in the transform suite id definitions 
and providing new definitions with larger sizes when needed?