609079 - Investigate suitability of SHA-256 as the extractor for J-PAKE

Status: RESOLVED FIXED

(Firefox :: Sync, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The reuslt of Diffie-Hellman key agreement is some key material with entropy that isn't uniformly distributed. Thus, a function (the "extractor") must be applied to the raw key material before it can be used as actual key material. Currently, we use SHA-256 as the extractor. Some papers have suggested that currently known hash functions may not be appropriate extractors, and this might be especially true given recent discoveries about SHA-2. On the other hand, there are others arguing that the hashes in the SHA-2 family are more than good enough for this particular usage and using a keyed/seeded extractor like HMAC would add complication. I will try to find a reference that clearly shows that SHA-256 is an acceptable extractor.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Research indicates it is better to use a hash keyed by an authenticated nonce but we don't have a way of authenticating a nonce.

See http://www.ietf.org/mail-archive/web/cfrg/current/msg02913.html and the eventual responses.

Comment 2

[Mike Connor [:mconnor]]

Is there anything left to do here?

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Nope. We already decided to use HKDF.