crypto primitives: hashes, HKDF, HKDF-ModHEADmaster

1 files changed, 222 insertions, 16 deletions

diff --git a/draft-guetschow-taler-protocol.xml b/draft-guetschow-taler-protocol.xml
index eab6d50..891e5e7 100644
--- a/draft-guetschow-taler-protocol.xml
+++ b/draft-guetschow-taler-protocol.xml
@@ -38,7 +38,7 @@
     <abstract>
 
 
-<?line 37?>
+<?line 41?>
 
 <t>[ TBW ]</t>
 
@@ -53,12 +53,131 @@
   <middle>
 
 
-<?line 41?>
+<?line 45?>
 
 <section anchor="introduction"><name>Introduction</name>
 
 <t>[ TBW ]</t>
 
+<t>Beware that this document is still work-in-progress and may contain errors.
+Use at your own risk!</t>
+
+</section>
+<section anchor="notation"><name>Notation</name>
+
+<t><list style="symbols">
+  <t><spanx style="verb">a | b</spanx> denotes the concatenation of a with b</t>
+</list></t>
+
+</section>
+<section anchor="cryptographic-primitives"><name>Cryptographic Primitives</name>
+
+<section anchor="cryptographic-hash-functions"><name>Cryptographic Hash Functions</name>
+
+<section anchor="sha256"><name>SHA-256</name>
+
+<t>Taler uses SHA-256 as defined in Section 5.1 of <xref target="RFC6234"></xref>.</t>
+
+</section>
+<section anchor="sha512"><name>SHA-512</name>
+
+<t>Taler uses SHA-512 as defined in Section 5.2 of <xref target="RFC6234"></xref>.</t>
+
+</section>
+<section anchor="sha512-trunc"><name>Truncated SHA-512</name>
+
+</section>
+</section>
+<section anchor="key-derivation-functions"><name>Key Derivation Functions</name>
+
+<section anchor="hkdf"><name>HKDF</name>
+
+<t>The Hashed Key Derivation Function (HKDF) used in Taler is an instantiation of <xref target="RFC5869"></xref>
+with two different hash functions for the Extract and Expand step as suggested in <xref target="HKDF"></xref>.
+HMAC-SHA512 (HMAC <xref target="RFC2104"></xref> instantiated with SHA-512, cf. <xref target="sha512"/>) is used for <spanx style="verb">HKDF-Extract</spanx>.
+HMAC-SHA256 (HMAC <xref target="RFC2104"></xref> instantiated with SHA-256, cf. <xref target="sha256"/>) is used for <spanx style="verb">HKDF-Expand</spanx>.</t>
+
+<figure><artwork><![CDATA[
+HKDF(salt, IKM, info, L) -> OKM
+
+Inputs:
+    salt     optional salt value (a non-secret random value);
+              if not provided, it is set to a string of 64 zeros.
+    IKM      input keying material
+    info     optional context and application specific information
+              (can be a zero-length string)
+    L        length of output keying material in octets
+              (<= 255*32 = 8160)
+
+Output:
+    OKM      output keying material (of L octets)
+]]></artwork></figure>
+
+<t>The output OKM is calculated as follows:</t>
+
+<figure><artwork><![CDATA[
+PRK = HKDF-Extract(salt, IKM) with Hash = SHA-512, HashLen = 64
+OKM = HKDF-Expand(PRK, info, L) with Hash = SHA-256, HashLen = 32
+]]></artwork></figure>
+
+</section>
+<section anchor="hkdf-mod"><name>HKDF-Mod</name>
+
+<t>Based on the HKDF defined in <xref target="hkdf"/>, this function returns an OKM that is smaller than a given big number N.</t>
+
+<figure><artwork><![CDATA[
+HKDF-Mod(N, salt, IKM, info) -> OKM
+
+Inputs:
+    N        big number; Nbits denotes the length of N in bits
+    salt     optional salt value (a non-secret random value);
+              if not provided, it is set to a string of 64 zeros.
+    IKM      input keying material
+    info     optional context and application specific information
+              (can be a zero-length string)
+
+Output:
+    OKM      output keying material (smaller than N)
+]]></artwork></figure>
+
+<t>The output OKM is calculated as follows:</t>
+
+<figure><artwork><![CDATA[
+Nlen = ceil(Nbits / 8)
+while true:
+    counter = 0
+    c = 2 least significant octets of counter in network-byte order
+    x = HKDF(salt, IKM, info | c, NLen)
+    reset all but lower Nbits bits in x
+    if x < N:
+        OKM = x
+        break
+    counter += 1
+]]></artwork></figure>
+
+</section>
+</section>
+<section anchor="non-blind-signatures"><name>Non-Blind Signatures</name>
+
+<section anchor="ed25519"><name>Ed25519</name>
+
+</section>
+</section>
+<section anchor="blind-signatures"><name>Blind Signatures</name>
+
+<section anchor="fdh-rsa"><name>FDH-RSA</name>
+
+</section>
+<section anchor="clause-schnorr"><name>Clause-Schnorr</name>
+
+</section>
+</section>
+</section>
+<section anchor="the-taler-crypto-protocol"><name>The Taler Crypto Protocol</name>
+
+<section anchor="withdrawal"><name>Withdrawal</name>
+
+</section>
 </section>
 <section anchor="security-considerations"><name>Security Considerations</name>
 
@@ -77,10 +196,74 @@
   <back>
 
 
+    <references title='Normative References' anchor="sec-normative-references">
+
+
+
+<reference anchor="RFC2104">
+  <front>
+    <title>HMAC: Keyed-Hashing for Message Authentication</title>
+    <author fullname="H. Krawczyk" initials="H." surname="Krawczyk"/>
+    <author fullname="M. Bellare" initials="M." surname="Bellare"/>
+    <author fullname="R. Canetti" initials="R." surname="Canetti"/>
+    <date month="February" year="1997"/>
+    <abstract>
+      <t>This document describes HMAC, a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind</t>
+    </abstract>
+  </front>
+  <seriesInfo name="RFC" value="2104"/>
+  <seriesInfo name="DOI" value="10.17487/RFC2104"/>
+</reference>
+
+<reference anchor="RFC5869">
+  <front>
+    <title>HMAC-based Extract-and-Expand Key Derivation Function (HKDF)</title>
+    <author fullname="H. Krawczyk" initials="H." surname="Krawczyk"/>
+    <author fullname="P. Eronen" initials="P." surname="Eronen"/>
+    <date month="May" year="2010"/>
+    <abstract>
+      <t>This document specifies a simple Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF), which can be used as a building block in various protocols and applications. The key derivation function (KDF) is intended to support a wide range of applications and requirements, and is conservative in its use of cryptographic hash functions. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
+    </abstract>
+  </front>
+  <seriesInfo name="RFC" value="5869"/>
+  <seriesInfo name="DOI" value="10.17487/RFC5869"/>
+</reference>
+
+<reference anchor="RFC6234">
+  <front>
+    <title>US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)</title>
+    <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
+    <author fullname="T. Hansen" initials="T." surname="Hansen"/>
+    <date month="May" year="2011"/>
+    <abstract>
+      <t>Federal Information Processing Standard, FIPS</t>
+    </abstract>
+  </front>
+  <seriesInfo name="RFC" value="6234"/>
+  <seriesInfo name="DOI" value="10.17487/RFC6234"/>
+</reference>
+
+<reference anchor="HKDF">
+  <front>
+    <title>Cryptographic Extraction and Key Derivation: The HKDF Scheme</title>
+    <author fullname="Hugo Krawczyk" initials="H." surname="Krawczyk">
+      <organization/>
+    </author>
+    <date year="2010"/>
+  </front>
+  <seriesInfo name="Advances in Cryptology – CRYPTO 2010" value="pp. 631-648"/>
+  <seriesInfo name="DOI" value="10.1007/978-3-642-14623-7_34"/>
+  <seriesInfo name="ISBN" value="[&quot;9783642146220&quot;, &quot;9783642146237&quot;]"/>
+<refcontent>Springer Berlin Heidelberg</refcontent></reference>
+
+
+
+
+    </references>
 
 
 
-<?line 57?>
+<?line 160?>
 
 <section anchor="change-log"><name>Change log</name>
 
@@ -98,19 +281,42 @@ Education and Research (BMBF) within the project Concrete Contracts.</t>
   </back>
 
 <!-- ##markdown-source:
-H4sIAAAAAAAAA22TzW7UMBDH736K0XKBg7NpkZAaCYm2SwuHVgi24kA5eO3Z
-xKxjR/ZkVwH1zbjxYoydQrWCS+SMfzPznw9LKcW+gZdCkCWHDSzWHcL17R2s
-lcMIH2KgoINbCBO0Vz0TJqotyXZESroLB0kZlMMjKLQibEOcGrB+G4SwQ2yA
-4pjotK7P6lNxCHHXxjAOmTA4IH88iUQRVX9s2+HEtGkEgISSp5x0nAYKbVRD
-NxUDapW6chrU1LNnEuIZ7NGP2PABIOIQGuiIhtQsl62lqvWjR6pCbJcumZql
-VWxeFtpxCYmeeAb+wy+FUCN1IbI8yckB5v7c2F1wysL1r59zh8odOzawvlvB
-KmLi4uDO2z3GZGmCsIU16s4HF9qp0GqzibjPDn/4Ys49Qhb2Dl3fBUff2VDB
-SV0uNYdqjnAdDOtZyfqkfnX2aBk95dlcY+yVn5Nhr6xroJ91V38n+4ZGaeZw
-lUEhfGAfYtUNT5Vn+/QnpJSsmdUoTULcf4H1xWe4/zpf9NYYh3ki7zl5MKMm
-G/wRli8/oR5jbsdl8MkajCpj6ZFbFY5DnN+e/0PcBo/VnGyj9C5zl53yLQJ3
-NP+d650PB4emnbfjR+PHfoMRzevFVrmEi4ejPOvOJsiLCgeVII3DECKh4eXk
-DYsEmwkov5PSRbjCrMXx5L3lHuSBirdcZpEHyhv4iAlV1B08v7i5uHoBB0sd
-x8ox+OF8Q025Jh2RMB9KH1MlfgM5XuVzngMAAA==
+H4sIAAAAAAAAA+1X23LbNhB9x1dsnRepNWVJvsRm6k59jT225YwvkwfH00Ak
+RKKCAA4IWlZc58v61h/rLkBJli8zbZ+bycggsNjrOctlFEXsLoZVxpx0SsSw
+dJUL+Ni7hiuuhIVP1jiTGLXEUpNoPkKJ1PKBi7JKuDLJzThyJBgVtSBLuBOZ
+sZMYpB4YxmRhY3C2Kl233d5qd9nY2GFmTVWQRCoKgT/asdJZwUeLe0MxQek0
+ZgAReDt+ldhJ4UxmeZFP/IZIeJn7VcEnI7xZMvYO7oSuRIwLACsKE0PuXFHG
+KyuZdK1MV1q4lrHZiirTNrrWwu0VL60whNLN5VHgFfkVxnjlcmPRvQiNA4T8
+nMmhUVzCx7/+DBnyZ3gxhqvrfdi3osTg4FrLO2FL6SZgBnAlklwbZbKJl+b9
+vhV3dGEq77cpRwIdOxJqlBvlvuFGCzptf5igqnhBPDEp+rMftTvtja16p9KO
+avNR2BHXwZgYcaliGAW/W7PK/uqqKA3qWqlgTBu849BrqsfF4V63016rl+ub
+G1v1cqO76nePTvYP0fj5cavTxv/t9ytb7zej1WhjrRt11lAqev/b6hriA1Ey
+08tYFEUYPcbFE8fYlxu42v0MX27DwUimqRJU22MMw6RV4qTRC2K7YsytAJdz
+hz+yBMRtRZAAXJdOKgUEwEhqgmyG4ZXAdQojPsHsaMelBmGtsWWLXZcCUM3E
+VBbMWIOV5fAHst4zjgfLEXzl8Af0vwJmySBs0KggRUQD7YWovBzG0uXQp8t7
+c/TKBAkmR5KCJ8g+PzxCWMNhpX2YXuAdXB7tRN31DXh4V+YcF4+MBapWJVqf
+nnIMXAykFikSCi6F1wDrrQ55c1OX6bY1V7ne6QaVuHipkk7fUtl9TeWVrXwK
+0hfKI0dHjz7aEzGBfWHlXUjUs0gJQXgtH6YD8gjzSvlAlW9cgwbdaJLX3sUQ
+g6T64mPpuHZyVpGbGrW3zFfGjQ2kcjAQlqCSU94HU28AAerLenDvYenxcnBf
+0J/SiYIyU1ZZhj0jGL4hPzATR2c7exHGT+E36MFbJdrcPnEI73gX6kQtQzJo
+wcNDXYrHJkXgQyI3vpLqqHbk69wE1fyfmUDJJyYIQG+YoPjQAvv+/TujrUbJ
+lVuG45OzZd/al+G0CdEvcH5yxtixLipXxqFLoRz4nldQ/rgKO3dcVQIaHLTR
+USkSKxxYtGFG4aj5wd+e/5MDFHWANL2TqUjRaiAx3nMGKYVNQuqMirmxBt+E
+NUhZuoce1grIKcCXCIlhi0HIcMXCycAsukjcF/ehtrwolEwCVMpCJHKAXJz1
+KaOf+dlIEGB9bBXeiUgJnWGug3dNL3s6Fa3P0GVTuVecI/SYxGEDfm7j523o
+rq//uNqFbdjsbLSbjJ17FSHn59OY39DbQJOnteqmL6knVC1NtzGzCVdJpTxc
+OKFeKTPGmnrxTxcnaPkp+uZ4aAZ0+W61PccxPZ/im24b68PIxOw+QauBGp8A
+6bkGD9O5htVucHraF6Izk2Kz5wRarBKx07eLJx3q4cF3jsfl8B6Y0hlnAVdZ
+7bsCOeXfFASrEVfUL/BZYykzbMlYVZmBrkZ93O89oQJZb/SW4RkjXqdDb1rD
+ubIP0OtLVy68M+bQ6JH3dP4/m16w6d+BfqGmvf+E+57y+EuEVI1QtBXYbLJx
+LpWgsVbE88EKLW1DPYzhqos15aWDUmaagsZeXDOQsjy9gbXGwdLPJP2JQ9ds
+6sdcgPuaMM8bL84byTL0kBihu+AMg0XESKGPMaHvhFbvqv9BA/esRsA9/Ay9
+eJbxQMr72TMOnXy4EM9P29CZMg/HHh3tKhzQ4RJD4kgjUb+qD1JsTp0tL/W6
+xOH+UXRxuRMe9hTH1010STOvtTQUUVHC+zpMQLMPD6/yMzYH/OwYc3qk0aOy
+NDfv4csZsWx5PTT4MXDfj4E4Ie70dl5IYASiFWbJPk+GfhxDbGRIP5PR004y
+1GasRJqFz4iHODBWpNtLA65KsfS4YOeKWgsVD8Z+CigKY+spoODWQX/iyR3G
+bTgU5IvCTwQtEdE0+bMDnGIDOYgsF1hLbpMcGrtnu4ehLcrQ35C5v+PQRTER
+2wUtfCNGov4NMZRdgccNAAA=
 
 -->