3
$\begingroup$

What is the difference between a PRF and a PRF+? I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences.

The IKE RFC defines a PRF as:

This pseudorandom function (PRF) takes as input a secret, a seed, and an identifying label and produces an output of arbitrary length.

The TLS 1.2 RFC defines a PRF as:

prf(key, msg) is the keyed pseudo-random function-- often a keyed hash function-- used to generate a deterministic output that appears pseudo-random.

The IKEv2 RFC defines a PRF as:

The PRF is used for the construction of keying material for all of the cryptographic algorithms used in both the IKE SA and the Child SAs.

The IKEv2 RFC defines a PRF+ as:

Since the amount of keying material needed may be greater than the size of the output of the PRF, the PRF is used iteratively. The term "prf+" describes a function that outputs a pseudorandom stream based on the inputs to a pseudorandom function called "prf".

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

IKEv2 uses the term PRF to refer to a negotiated keyed random-looking function (for example, possibly HMAC-SHA256). IKEv2 uses the term PRF+ to refer to a specific construction based on that underlying negotiated function, as defined in section 2.13:

prf+ is defined as:

prf+ (K,S) = T1 | T2 | T3 | T4 | ...

where:
T1 = prf (K, S | 0x01)
T2 = prf (K, T1 | S | 0x02)
T3 = prf (K, T2 | S | 0x03)
T4 = prf (K, T3 | S | 0x04)
...

The term PRF+ has no generally accepted meaning outside of IKEv2.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ Looks identical to HKDF-Expand. $\endgroup$
    – CodesInChaos
    Commented Jul 7, 2015 at 6:24
  • $\begingroup$ Hi Poncho, thanks for the answer. I am was nearly going to mark it as the right answer, but I'm still not sure I fully understand your answer. I don't suppose you could dumb it down just a bit, write it to a target audience that isn't as well versed in crypto or college math? $\endgroup$
    – Eddie
    Commented Jul 7, 2015 at 13:20
  • $\begingroup$ Also, a follow on question: Is it safe to understand IKEv2's definition of PRF+ and IKEv1/TLS's definition of PRF as to mean the same thing? Are both simply each individual protocol's strategy to create a arbitrary length output which is always identical if starting with identical inputs? $\endgroup$
    – Eddie
    Commented Jul 7, 2015 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.