Subject: RE: [Ipsec] Question about PRFs with fixed size key

From: [email-masked]
Date: Fri, 28 Jan 2005 14:54:18 +0200

Tero Kivinen writes:
> 
> There is also other places where it is little bit ambiguous
> what do if fixed length PRFs are used. The section 2.14 says
> that if we are using PRF with fixed length key, then
> 
> 1) If the length(Ni) + length(Nr) == fixed_length_key_length
>    use prf(Ni | Nr, ...)
> 2) If the length(Ni) + length(Nr) != fixed_length_key_length
>    use Ni and Nr so that half of the bits of key must come 
>    from Ni and half from Nr,taking first bits of each.
> 
> Now if the fixed length key length is 512 bits, and the Ni is
> 128 bits, annd Nr is 1024 bits, how do we generate the key for
> the PRF?
> 
> a) Pad Ni to 256 bits by zeros, and then take 256 bits from it, 
>    and concatenate it with first 256 bits of Nr?
> b) Take 128 bits of Ni, and concatenate it with 384 bits 
>    from Nr?
> 
> What if Nr is also 128 bits long? Do we then concatenate Ni
> and Nr to form a 256 bit long secret which is then padded with
> zeros?
> 
> Currently this cannot yet happen as the nonces must be >= 128
> bits long, and the only fixed size PRF is PRF_AES128_CBC and
> that has key length of 128 bits.

I would say that if the initiator proposes a PRF that has fixed
key length of >256 bits, it can also choose Ni that is long
enough (at least key length/2 bits); and likewise for the
responder, if it accepts this PRF, it can include sufficiently
long Nr.

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec