Subject: [Hipsec] No changes to KEYMAT at this time

From: Robert Moskowitz <[email-masked]>
Date: Wed, 09 Dec 2009 15:01:08 -0500

Well, I did some investigation, and stuck my neck out a bit and asked on 
the cfrg list...

Not all MACs can be used for KDFs.  This discussion has actually been 
going on for some time on the cfrg list.

There is work, being led by Hugo Krawczyk (or it appears that Hugo is 
leading and others are at best chasing him) to develop a new 'uniform' 
KDF.  At this time I do not want to hitch HIP's timeline to that getting 
done, but I am open to other opinions on this matter.

This means that for now, HMAC stays in the spec and thus code base.  
Although there are other very good MACs like CMAC and GMAC, HMAC is not 
being pushed away.  Further, if Hugo's HKDF moves forward as an RFC and 
NIST acceptance, and HIP adopts it, we still have HMAC.

ERGO:

KEYMAT remains unchanged, based on HMAC, and uses RHASH as currently 
specified.

HIP exchange continues to use HMAC and this is not negotiable, that is 
there are no alternatives to HMAC, like CMAC or GMAC.  Thus the HIP 
parameters, HMAC and HMAC_2 remain as is and also any HIP parameters 
that have HMAC buried within them.

Thus 'crypto agility' is limited to HASH, DH, and PK selection.  We are 
adding HASH and improving on how we handle DH and PK.

Does this work for others here?  And in light of the discussion on the 
cfrg list does this address the IESG's 'crypo agility' concerns?

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 09 Dec 2009 16:03:07 -0500

Robert Moskowitz wrote:
> Well, I did some investigation, and stuck my neck out a bit and asked 
> on the cfrg list...
>
> KDF. At this time I do not want to hitch HIP's timeline to that 
> getting done, but I am open to other opinions on this matter.

I am reading the HKDF draft: draft-krawczyk-hkdf-00.txt which expires in 
10 days, I suspect Hugo will fix this.

Anyway it states:

This document specifies a simple HMAC-based [HMAC] KDF, named HKDF,
which can be used as a building block in various protocols and
applications, and is already used in several IETF protocols,
including [IKEv2], [PANA], and [EAP-AKA].

So will someone take a close look at this and see what it would take for 
HIP to use HKDF? What are the diffs between what we have and HKDF?

> Although there are other very good MACs like CMAC and GMAC, HMAC is 
> not being pushed away. Further, if Hugo's HKDF moves forward as an RFC 
> and NIST acceptance, and HIP adopts it, we still have HMAC.
>
> ERGO:
>