Subject: Re: question about section 3.6.1.1 simple s2k: how does preloading work?

From: [email-masked]
Date: Fri, 12 May 2000 08:15:42 -0400

The "preloading" means to hash the preloaded data.  In other words,
the preloaded data is a prefix to the rest of the data to be hashed.
It is not inserted directly into the state variables.

Without preloading, you would do hash(data).  Preloading one byte of
zero you would do hash(0,data).  Preloading two bytes of data you would
do hash(0,0,data), and so on, where the commas represent concatenation.

Hal

---

From: Paul Koning <[email-masked]>
Date: Fri, 12 May 2000 11:41:52 -0400 (EDT)

>>>>> "hal" == hal  <[email-masked]> writes:

 hal> The "preloading" means to hash the preloaded data.  In other
 hal> words, the preloaded data is a prefix to the rest of the data to
 hal> be hashed.  It is not inserted directly into the state
 hal> variables.

 hal> Without preloading, you would do hash(data).  Preloading one
 hal> byte of zero you would do hash(0,data).  Preloading two bytes of
 hal> data you would do hash(0,0,data), and so on, where the commas
 hal> represent concatenation.

The use of terms like "preloading" and "multiple instances of the hash
context" makes it sound like a description of an implementation, which
of course isn't what you want in a protocol spec.  I wonder if it
would help to phrase it in the other way you just used: hash (data)
concatenated with hash (0 data) concatenated with ...

The key extension description in the IKE spec is done in this way, if
memory serves.

       paul

---

From: [email-masked]
Date: Sun, 14 May 2000 12:26:41 +0900

From: [email-masked]
Subject: Re: question about section 3.6.1.1 simple s2k: how does preloading work?
Date: Fri, 12 May 2000 08:15:42 -0400
Message-ID: <[email-masked]>

> do hash(0,0,data), and so on, where the commas represent concatenation.

thank you very much for the clarification, i think i understand now.

initially, i had thought that that might have been what was meant, but
since elsewhere in the rfc the term "append" is used (5.1 and 5.5.3)
to describe a similar type of concatenation, i thought that the term
"prepend" might have been used if that was what was meant :-)

also, the phrasing involving "perloading hash contexts" was confusing
to me -- my image of a hash context comes from the source code of rfc
1321:

MD5_CTX *context;                                        /* context */
{
  context->count[0] = context->count[1] = 0;
  /* Load magic initialization constants.
*/
  context->state[0] = 0x67452301;
  context->state[1] = 0xefcdab89;
  context->state[2] = 0x98badcfe;
  context->state[3] = 0x10325476;
}

this particular "context" doesn't appear to contain any octets from
the message data to be hashed.

is there a generally accepted definition for what constitutes a hash
context?

---

From: Jon Callas <[email-masked]>
Date: Mon, 15 May 2000 13:53:36 -0700

I'll look at clarifying the text.

	Jon

---

From: [email-masked]
Date: Tue, 16 May 2000 11:40:38 +0900

From: Jon Callas <[email-masked]>
Subject: Re: question about section 3.6.1.1 simple s2k: how does preloading work?
Date: Mon, 15 May 2000 13:53:36 -0700
Message-ID: <p04310100b5461443b203@[63.73.97.188]>

> I'll look at clarifying the text.

thanks very much.

i have some additional questions about the two subsequent sections.  section
3.6.1.2 says:

   Salted S2K is exactly like Simple S2K, except that the input to the
   hash function(s) consists of the 8 octets of salt from the S2K
   specifier, followed by the passphrase.

i presume this means that if the hash size is less than the key size,
the method of utilizing multiple hash contexts and prepending octets
of zeros described in 3.6.1.1 is employed.

i assume that this also applies to iterated and salted s2k (section 3.6.1.3).

if that is the case, suppose that the hash size is less than the key size:

1) for the second and subsequent hash context instances, do the octets
   of zeros get prepended to the salt:

     zero(s) + salt + passphrase

  or are the zeros prepended to the passphrase:

     salt + zero(s) + passphrase

  ?  i presume it is the former, is that correct?

2) for iterated and salted s2k, is the calculated octet count value
   taken over all hash context instances or just the first instance?

thanks.