<div dir="ltr">So far, I haven't heard anything I object to. Could someone with strong feelings about KeyDigest use rewrite the spec? Are there any other areas we want to rewrite (the definition of HMAC)?<div><br></div><div>Otherwise, it sounds like this is something we would implement soon.</div><div><br></div><div>-Adeola</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 22, 2014 at 10:02 AM, Thompson, Jeff <span dir="ltr"><<a href="mailto:jefft0@remap.ucla.edu" target="_blank">jefft0@remap.ucla.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hash output length vs. block size…</div>
<div><br>
</div>
<div>Marc is right. The HmacWithSha256 algorithm hashes the key when it is longer than the block size (64 bytes), not the hash output length (32 bytes). So we would prohibit keys longer than 64 bytes (not 32 bytes).</div>
<div><br>
</div>
<div>Also, most applications will use a crypto library's HMAC function which should automatically hash the key if it is longer than the block size. It could be confusing to put this in the spec since the application writer may unnecessarily has the key when
the crypto library will do it anyway, and more efficiently.</div>
<div><br>
</div>
<div>- Jeff T</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt"><span class="">
<span style="font-weight:bold">From: </span><Thompson>, Jeff Thompson <<a href="mailto:jefft0@remap.ucla.edu" target="_blank">jefft0@remap.ucla.edu</a>><br>
<span style="font-weight:bold">Date: </span>Monday, September 22, 2014 9:53 AM<br>
</span><span style="font-weight:bold">To: </span>Yingdi Yu <<a href="mailto:yingdi@cs.ucla.edu" target="_blank">yingdi@cs.ucla.edu</a>>, Adeola Bannis <<a href="mailto:abannis@ucla.edu" target="_blank">abannis@ucla.edu</a>><span class=""><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:ndn-interest@lists.cs.ucla.edu" target="_blank">ndn-interest@lists.cs.ucla.edu</a>" <<a href="mailto:Ndn-interest@lists.cs.ucla.edu" target="_blank">Ndn-interest@lists.cs.ucla.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Ndn-interest] Adding HMAC to available NDN signature types<br>
</span></div><span class="">
<div><br>
</div>
<div>
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On Fri, Sep 19, 2014 at 11:18 PM, Yingdi Yu <span dir="ltr"><<a href="mailto:yingdi@cs.ucla.edu" target="_blank">yingdi@cs.ucla.edu</a>></span> wrote:</div>
</div>
</div>
</div>
<div>> However, when key is longer than the hash output, putting key digest into key locator directly expose the secret to other.</div>
<div><br>
</div>
<div>Oh crap, you're right! Thanks for pointing that out. I agree that we should prohibit KeyDigest in the case that the key is longer than 32 bytes. I would reword the reason slightly: "When the key is longer than 32 bytes, the HmacWithSha256 algorithm
uses the SHA-256 digest of the key, which would be the same as the KeyDigest, effectively exposing the secret."</div>
<div><br>
</div>
<div>- Jeff T</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Yingdi Yu <<a href="mailto:yingdi@cs.ucla.edu" target="_blank">yingdi@cs.ucla.edu</a>><br>
<span style="font-weight:bold">Date: </span>Sunday, September 21, 2014 12:00 AM<br>
<span style="font-weight:bold">To: </span>Adeola Bannis <<a href="mailto:abannis@ucla.edu" target="_blank">abannis@ucla.edu</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:ndn-interest@lists.cs.ucla.edu" target="_blank">ndn-interest@lists.cs.ucla.edu</a>" <<a href="mailto:Ndn-interest@lists.cs.ucla.edu" target="_blank">Ndn-interest@lists.cs.ucla.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Ndn-interest] Adding HMAC to available NDN signature types<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap:break-word">
<span style="text-align:-webkit-auto">On Sep 20, 2014, at 11:18 AM, Adeola Bannis <<a href="mailto:abannis@ucla.edu" target="_blank">abannis@ucla.edu</a>> wrote:</span><br>
<div><br>
<blockquote type="cite">
<div dir="ltr"><br>
<div class="gmail_extra">
<div class="gmail_quote">On Fri, Sep 19, 2014 at 11:18 PM, Yingdi Yu <span dir="ltr">
<<a href="mailto:yingdi@cs.ucla.edu" target="_blank">yingdi@cs.ucla.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div><span style="border-collapse:separate;font-family:Helvetica;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><span style="border-collapse:separate;font-family:Helvetica;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
<div style="word-wrap:break-word"><br>
</div>
</span></span></div>
<div><span>
<div>@Adeola, you probably want to forbid KeyDigest in KeyLocator for this HMAC signature. Because if key size is longer than hash output, the key digest is used instead. If we allow KeyDigest in KeyLocator, then some careless programmers may leak the secret.
</div>
</span></div>
</div>
</blockquote>
<div><br>
</div>
<div>Well, a careless programmer could put a passphrase, or something used to derive the key, into a KeyLocator KeyName as well. We can go ahead and make the restriction, but there are other ways a programmer could shoot herself in the foot here.</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<div>I did not mean that "careless" as you describe. I mean those who do not know the details of HMAC.</div>
<div><br>
</div>
<div>The problem is that when key is shorter than hash output, it is safe to put key digest in the key locator. However, when key is longer than the hash output, putting key digest into key locator directly expose the secret to other, i.e., attackers can directly
use the key digest to construct any legitimate HMAC. Therefore you either explicitly specify what should be used when KeyDigest is used as the KeyLocator, or you can disable the usage of KeyDigest in KeyLocator.</div>
<div><br>
</div>
<div>Yingdi </div>
</div>
</div>
</span></div>
</div>
</span></span>
</div>
</blockquote></div><br></div>