To: bitcoin-dev@lists.linuxfoundation.org
References: <87h9cecad5.fsf@rustcorp.com.au>
	<577224E8.6070307@jonasschnelli.ch> <8760ssdd1u.fsf@rustcorp.com.au>
	<CAEM=y+XKQZVz6UieB-nDy_C9xTmXiBB3-atuuZkxzmPoSVPOJw@mail.gmail.com>
	<87oa6iavky.fsf@rustcorp.com.au>
	<CADorodhC=UvQmiNVSd91dA57PyYydDH+uUUp_Aj5CsN-EG-e4g@mail.gmail.com>
From: Jonas Schnelli <dev@jonasschnelli.ch>
Message-ID: <577A0439.5000506@jonasschnelli.ch>
Date: Mon, 4 Jul 2016 08:37:45 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0)
	Gecko/20100101 Thunderbird/38.7.2
MIME-Version: 1.0
In-Reply-To: <CADorodhC=UvQmiNVSd91dA57PyYydDH+uUUp_Aj5CsN-EG-e4g@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature";
	boundary="RtHsO4uOF1X3c1LIi6gRU9ib8mnSxSeLv"
Subject: Re: [bitcoin-dev] BIP 151 use of HMAC_SHA512
Precedence: list

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--RtHsO4uOF1X3c1LIi6gRU9ib8mnSxSeLv
Content-Type: multipart/mixed; boundary="lxbg2tmm0vXDrM2sIQBitmqnVkFETeE93"
From: Jonas Schnelli <dev@jonasschnelli.ch>
To: bitcoin-dev@lists.linuxfoundation.org
Message-ID: <577A0439.5000506@jonasschnelli.ch>
Subject: Re: [bitcoin-dev] BIP 151 use of HMAC_SHA512
References: <87h9cecad5.fsf@rustcorp.com.au>
 <577224E8.6070307@jonasschnelli.ch> <8760ssdd1u.fsf@rustcorp.com.au>
 <CAEM=y+XKQZVz6UieB-nDy_C9xTmXiBB3-atuuZkxzmPoSVPOJw@mail.gmail.com>
 <87oa6iavky.fsf@rustcorp.com.au>
 <CADorodhC=UvQmiNVSd91dA57PyYydDH+uUUp_Aj5CsN-EG-e4g@mail.gmail.com>
In-Reply-To: <CADorodhC=UvQmiNVSd91dA57PyYydDH+uUUp_Aj5CsN-EG-e4g@mail.gmail.com>

--lxbg2tmm0vXDrM2sIQBitmqnVkFETeE93
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

> I haven't been able to find the beginning of this thread, so apologies
> if I've misunderstood what this is for, but it _sounds_ like we're
> re-inventing HKDF.

> I'd recommend reading the paper about HKDF. It stands out among crypto
> papers for having a nice clear justification for each of its design
> decisions, so you can see why they did it (very slightly) differently
> than the various constructions proposed up-thread.

Thanks Zooko

I think HKDF instead of a single HMAC_SHA512 seams reasonable and
something we should consider.

I'll try to evaluate the implications of using HKDF over HMAC_SHA512 and
will update the BIP if there are no concerns about it.

</jonas>


--lxbg2tmm0vXDrM2sIQBitmqnVkFETeE93--

--RtHsO4uOF1X3c1LIi6gRU9ib8mnSxSeLv
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXegQ5AAoJECnUvLZBb1PsadYP/AtGE6LRj6eSrPa47hzzTig1
FkX+qQCom6HGAPnAMWs5cKwh7FlBaptF2aM5GcyhvcP7ZRNA0ib/Qe3i4mxl3DQ1
XCYAbReHKRcv1/Iui/jRoNozN9EliaWt9p36TVEYtJDAOOp9jUxRE683UiZl03nd
SFYcnCsvmIERiTYSYYC8qHcvdzw2whfAt7f0vLDtoVH3ozFfFvbSOlYJs/FAdK22
RBaciE4g5vR4KqmHoO/vGot+2+TpaQ9I6qrVsKEIlIOlS3Y8iGn1UOx6YGNC5E25
MxY0DqAbMnUHM+nFXCGOhsc0zZw2AN7I/Y7BSQovQmycsTd3kp51H2IRY39xWCe4
yqvrH1BqueWiC4J91imQCgnNmV7MYEFApj/t4z5MAxJIgtrP6xVneeOuRRiuhoKa
m4z82Mu15bQ8CaFhJnD8YC8ZcQPTn8UA00pNXBcACGtCSehSfFHxScMb3H6fgsus
Jgrd4ToGykG6fuXlT2FlPBx6ixbBs9sSpveQEu0uuHDDw7cxCh8ifDyegv8fJQ9L
holZb99BRgN1AwPOGSRdj/SW6E0+BGaHOZQEgZ9r/hkhoZDEUr9PKDjevUMAwSpY
KDFGTEHO//xhsHrz5/KO6QMgypNorkeNie6hqETYvpNOrdo6MB9AleVj4IuVtHnG
jiMxhXs6AaetAleOqWFn
=YmIl
-----END PGP SIGNATURE-----

--RtHsO4uOF1X3c1LIi6gRU9ib8mnSxSeLv--