Subject: RE: [eap] EAP-AKA Key derivation

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 9 Jan 2006 08:49:35 -0800

At the time of development of EAP-AKA and EAP-SIM we received comments
on using a standard PRF.  This was the recommendation from NIST on a PRF
so we adopted it. I don't believe it to be any better or worse than PRF+
using HMAC-SHA1 used in IKEv2 but at the time PRF+ was not standardized.
SIM manufacturers have built EAP-SIM into smart cards, I don't remember
if this came as a request from them or not. 

Joe

> -----Original Message-----
> From: Thomas Otto [mailto:[email-masked]] 
> Sent: Monday, January 09, 2006 7:58 AM
> To: [email-masked]
> Subject: Re: [eap] EAP-AKA Key derivation
> 
> Hi Bernard, all,  
> 
> > It is very common for IETF specifications to reference cryptographic
> > functions defined outside of the IETF.  Examples include 
> AES and DES, both
> > of which are defined in NIST documents.
> 
> This may be, but in the IETF, also appropriate mechanisms 
> have been developed.
> As I said before, for instance the prf+ in IKEv2. 
> 
> So why abstain from using this PRF? The HMAC construction 
> seems much more
> comprehensible than the DSS-PRF. 
> 
> Is there a particular advantage which I haven't recognized? 
> IS the DSS-PRF 
> built-in in the USIM, for instance? This would be an 
> argument, to re-use the
> implementation.
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/eap
> 
> Arhives: http://lists.frascone.com/pipermail/eap
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: Thomas Otto <[email-masked]>
Date: Tue, 10 Jan 2006 12:49:00 +0100

Hi all,

Just for curiosity, I looked at implementations of the IKEv2 PRF and DSS-PRF.
EAP-FAST uses the IKEv2 PRF.
EAP-SIM and AKA uses the DSS-PRF.

The opensource project wpa_supplicant has implemented these KDFs. 
My feeling has been that the DSS-PRF is not as efficient ... however, at least
for the particular implementation of wpa_supplicant, this is NOT true.

The bottom-line (for the urgent reader): 
==> The DSS-PRF is about 7-8x faster (regardless if 140 or 512 byte output).

For the interested reader:
The machine tested is an Amilo notebook, 1024 MB RAM, 1.7 GHz Intel Pentium M.

---------------------------
 parameters: 140 outputsize / byte 
 iterations: 100000 

Testing EAP-SIM PRF ...  100000 iterations: 1.783396 seconds 
Testing EAP-FAST PRF ...   100000 iterations: 12.632675 seconds 

The ratio IKEv2-KDF / DSS-KDF = 7.083494
-------------------
 parameters: 512 outputsize / byte 
 iterations: 100000 

Testing EAP-SIM PRF ...  100000 iterations: 5.855131 seconds 
Testing EAP-FAST PRF ...  100000 iterations: 47.793291 seconds 
The ratio IKEv2-KDF / DSS-KDF = 8.162634-------

The source file is available here: 
http://www.tu-bs.de/~y0013790/prftest.c

This file must be copied into the wpa_supplicant directory, 
it can be compiled with

$  gcc  -MMD -O2 -Wall -g  -I. -I../utils -I../hostapd prftest.c sha1.c md5.c 
common.c -o prftest.o