Subject: Re: questions about sections 3.6.1.2 and 3.6.1.3 (was Re: question about section 3.6.1.1 simple s2k: how does preloading work?)

From: [email-masked]
Date: Mon, 15 May 2000 20:41:58 -0400

> i have some additional questions about the two subsequent sections.  section
> 3.6.1.2 says:
>
>    Salted S2K is exactly like Simple S2K, except that the input to the
>    hash function(s) consists of the 8 octets of salt from the S2K
>    specifier, followed by the passphrase.
>
> i presume this means that if the hash size is less than the key size,
> the method of utilizing multiple hash contexts and prepending octets
> of zeros described in 3.6.1.1 is employed.

Yes.

> i assume that this also applies to iterated and salted s2k (section 3.6.1.3).

Yes.

> if that is the case, suppose that the hash size is less than the key size:
>
> 1) for the second and subsequent hash context instances, do the octets
>    of zeros get prepended to the salt:
>
>      zero(s) + salt + passphrase
>
>   or are the zeros prepended to the passphrase:
>
>      salt + zero(s) + passphrase
>
>   ?  i presume it is the former, is that correct?

Yes.

> 2) for iterated and salted s2k, is the calculated octet count value
>    taken over all hash context instances or just the first instance?

The count is per-instance.  Each instance is given a number of bytes of
salt and passphrase, equal to the calculated octet count.  The pre-loaded
zeros are not included in this count.

Hal

---

From: [email-masked]
Date: Tue, 16 May 2000 13:44:45 +0900

From: [email-masked]
Subject: Re: questions about sections 3.6.1.2 and 3.6.1.3 (was Re: question about section 3.6.1.1 simple s2k: how does preloading  work?)
Date: Mon, 15 May 2000 20:41:58 -0400
Message-ID: <[email-masked]>

...

> The count is per-instance.  

i think i understand now.

> Each instance is given a number of bytes of salt and passphrase,
> equal to the calculated octet count.  The pre-loaded zeros are not
> included in this count.

ok, i think i've got it -- below is an outline of my current understanding.

for each hash context instance, the initial input is:

output from the hash, o1, is a fixed number of bytes, h.

if the length of salt + passphrase in bytes is less than the
calculated octet count, then o1 is given as input to the hash
function which produces o2 (also length h).

if the length of salt + passphrase + o1 is less than the calculated
octet count, then o2 is given as input to the hash function and the
process continues until the length of:

  salt + passphrase + o1 + ... + on

is greater than or equal to the calculated octet count.

also, none of o1, ..., on have octets of zeros prepended.

is this correct?

thanks again for the clarifications.