[JIRA] (OSJ-355) ConcatKDF parameter requirements too restrictive in ECDH

[Stefan Santesson (Jira)]

Stefan Santesson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5e1f387fa531f30ca3849078 ) *commented* on OSJ-355 ( https://shibboleth.atlassian.net/browse/OSJ-355?atlOrigin=eyJpIjoiYWJiNDdkODVmYmNkNDhiYjk2ZGY3Y2NjMWQ4ZDhkZDIiLCJwIjoiaiJ9 )

Re: ConcatKDF parameter requirements too restrictive in ECDH ( https://shibboleth.atlassian.net/browse/OSJ-355?atlOrigin=eyJpIjoiYWJiNDdkODVmYmNkNDhiYjk2ZGY3Y2NjMWQ4ZDhkZDIiLCJwIjoiaiJ9 )

Great!

On the empty string ““ I just want to make sure we don’t disconnect. In this particular case it is different from other cases since the first byte “00” is not part of the concatenated data, but just a padding bit counter. This makes “00” equivalent to ““. “00” meaning 0 padding bits and no data. And ““ means absent padding declaration which then defaults to 00, followed by no data. I.e “00” and ““ both represent an empty byte array.

I think that is what you mean, but just making sure.

*Note* : The fact that XML disg decided to include a leading padding bit counter byte is highly redundant IMO as no implementation of hash functions publicly available can handle arbitrary bit length input (even if the algorithm in theory can). They could just as well have removed that declaration and required full bytes as input parameters instead. That would have been much less confusing.

When we first interop tested with the German implementation, this was what they had missed (as they included the counter byte in the concatenated data). And that is an easy mistake to make.

( https://shibboleth.atlassian.net/browse/OSJ-355#add-comment?atlOrigin=eyJpIjoiYWJiNDdkODVmYmNkNDhiYjk2ZGY3Y2NjMWQ4ZDhkZDIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-355#add-comment?atlOrigin=eyJpIjoiYWJiNDdkODVmYmNkNDhiYjk2ZGY3Y2NjMWQ4ZDhkZDIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100201- sha1:c6c9d1f )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220630/8c0d7be5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-fed1b858-33c6-4803-8ef7-a06203ac3bc7
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220630/8c0d7be5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-3194cbb7-7705-4147-b57d-d09a8b3ef215
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220630/8c0d7be5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-1a9d0c84-32a8-4c70-a8a3-7a157c820348
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220630/8c0d7be5/attachment-0005.png>