crypto primitives: hashes, HKDF, HKDF-ModHEADmaster

1 files changed, 103 insertions, 0 deletions

diff --git a/draft-guetschow-taler-protocol.md b/draft-guetschow-taler-protocol.md
index 79e05b7..460bc4e 100644
--- a/draft-guetschow-taler-protocol.md
+++ b/draft-guetschow-taler-protocol.md
@@ -30,6 +30,10 @@ author:
     email: mikolai.guetschow@tu-dresden.de
 
 normative:
+  RFC2104:
+  RFC5869:
+  RFC6234:
+  HKDF: DOI.10.1007/978-3-642-14623-7_34
 
 informative:
 
@@ -44,7 +48,106 @@ informative:
 
 \[ TBW \]
 
+Beware that this document is still work-in-progress and may contain errors.
+Use at your own risk!
 
+# Notation
+
+- `a | b` denotes the concatenation of a with b
+
+# Cryptographic Primitives
+
+## Cryptographic Hash Functions
+
+### SHA-256 {#sha256}
+
+Taler uses SHA-256 as defined in Section 5.1 of [RFC6234].
+
+### SHA-512 {#sha512}
+
+Taler uses SHA-512 as defined in Section 5.2 of [RFC6234].
+
+### Truncated SHA-512 {#sha512-trunc}
+
+## Key Derivation Functions
+
+### HKDF {#hkdf}
+
+The Hashed Key Derivation Function (HKDF) used in Taler is an instantiation of [RFC5869]
+with two different hash functions for the Extract and Expand step as suggested in [HKDF].
+HMAC-SHA512 (HMAC [RFC2104] instantiated with SHA-512, cf. {{sha512}}) is used for `HKDF-Extract`.
+HMAC-SHA256 (HMAC [RFC2104] instantiated with SHA-256, cf. {{sha256}}) is used for `HKDF-Expand`.
+
+~~~
+HKDF(salt, IKM, info, L) -> OKM
+
+Inputs:
+    salt     optional salt value (a non-secret random value);
+              if not provided, it is set to a string of 64 zeros.
+    IKM      input keying material
+    info     optional context and application specific information
+              (can be a zero-length string)
+    L        length of output keying material in octets
+              (<= 255*32 = 8160)
+
+Output:
+    OKM      output keying material (of L octets)
+~~~
+
+The output OKM is calculated as follows:
+
+~~~
+PRK = HKDF-Extract(salt, IKM) with Hash = SHA-512, HashLen = 64
+OKM = HKDF-Expand(PRK, info, L) with Hash = SHA-256, HashLen = 32
+~~~
+
+### HKDF-Mod
+
+Based on the HKDF defined in {{hkdf}}, this function returns an OKM that is smaller than a given big number N.
+
+~~~
+HKDF-Mod(N, salt, IKM, info) -> OKM
+
+Inputs:
+    N        big number; Nbits denotes the length of N in bits
+    salt     optional salt value (a non-secret random value);
+              if not provided, it is set to a string of 64 zeros.
+    IKM      input keying material
+    info     optional context and application specific information
+              (can be a zero-length string)
+
+Output:
+    OKM      output keying material (smaller than N)
+~~~
+
+The output OKM is calculated as follows:
+
+~~~
+Nlen = ceil(Nbits / 8)
+while true:
+    counter = 0
+    c = 2 least significant octets of counter in network-byte order
+    x = HKDF(salt, IKM, info | c, NLen)
+    reset all but lower Nbits bits in x
+    if x < N:
+        OKM = x
+        break
+    counter += 1
+~~~
+
+## Non-Blind Signatures
+
+### Ed25519
+
+## Blind Signatures
+
+### FDH-RSA
+
+### Clause-Schnorr
+
+# The Taler Crypto Protocol
+
+## Withdrawal
 
 # Security Considerations