[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: AW: [pkcs11] Groups - Flexible KDF Draft 1 uploaded
Thank you for your explanation. That clarifies my feedback/questions.
Sent from my smartphone.
-------- Ursprüngliche Nachricht --------
Von: Johnson Darren
Datum:29.03.2017 15:47 (GMT+01:00)
An: Dieter Bong , firstname.lastname@example.org
Betreff: RE: [pkcs11] Groups - Flexible KDF Draft 1 uploaded
I believe most of your comments were editorial mistakes on my part. You had one question about the following text, which I agree does not make sense.
This mechanism requires that at least one CK_FKDF_DATA_PARAM of type CK_FKDF_COUNTER must be defined. Beyond that requirement, any number of CK_FKDF_DATA_PARAM structures can be defines as was as any number of duplicate types and values.
It should be the following, which is supposed to explain any number and combination of data parameters are allowed, including parameters with the same type and values. The algorithm does not care as it simply concatenates them together.
This mechanism requires that at least one CK_FKDF_DATA_PARAM of type CK_FKDF_COUNTER must be defined. Beyond that requirement, any number of CK_FKDF_DATA_PARAM structures can be defined as well as any number of duplicate types and values.
For the counter… the counter value defined in CK_FKDF_COUNTER_PARAM is used to define the initial counter value. The KDF is an iterative algorithm produce a block of output from the PRF each iteration and the counter is incremented internal to the KDF as each iteration is performed. The number of iterations required is defined by the size of the PRF output and the size and number of keys you want to derive. The counter is used to ensure that each block of output is unique from the previous block. How the counter is used and incremented is defined in SP800-108, but I could include some more text in my proposal to clarify that if you think it is worthwhile.
Thanks for you feed back, and I’ll upload an updated version after I incorporate all of the comments.
that’s an interesting proposal. I have included a few minor comments and questions in the document itself, please check the track changes and comments. The most important question for me is: When passing (a pointer to) a CK_FKDF_COUNTER_PARAM structure, is C_Derive supposed to increment that counter after using for key derivation? Or is the application supposed to increment the counter after C_Derive has returned? Please clarify.
On Behalf Of Darren Johnson
This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.
Utimaco IS GmbH
Germanusstr. 4, D.52080 Aachen, Germany, Tel: +49-241-1696-0, www.utimaco.com
Seat: Aachen – Registergericht Aachen HRB 18922
VAT ID No.: DE 815 496 496
Managementboard: Malte Pollmann (Chairman) CEO, Dr. Frank J. Nellissen CFO
This communication is confidential. We only send and receive email on the basis of the terms set out at https://www.utimaco.com/en/e-mail-disclaimer/