Hi, based on the discussion in the ML, this version adds back a "0x01" trailer for the "prf+" use (as Wang Xi and Thom Wiggers proposed).
The text is also re-structured and some clarifications are added. Please check whether the current separation between "prf" and "prf+" is sufficient (the KMAC's "customization string" is still not used). Regards, Valery. > Internet-Draft draft-ietf-ipsecme-ikev2-prf-plus-02.txt is now available. It > is a work item of the IP Security Maintenance and Extensions (IPSECME) WG of > the IETF. > > Title: Use of Variable-Length Output Pseudo-Random Functions (PRFs) in > the Internet Key Exchange Protocol > Version 2 (IKEv2) > Author: Valery Smyslov > Name: draft-ietf-ipsecme-ikev2-prf-plus-02.txt > Pages: 7 > Dates: 2026-08-28 > > Abstract: > > This document specifies the use of variable-length output Pseudo- > Random Functions (PRFs) in the Internet Key Exchange Protocol Version > 2 (IKEv2). Current IKEv2 specification relies on traditional PRFs > with fixed output length for key derivation and uses iterative > application of a PRF (called "prf+") in cases when longer output is > required. Appearance of PRFs that can output as much bits as > requested allows to streamline the key derivation functions of IKEv2. > > This document updates RFC 7296 and RFC 7815 for the cases when > variable-length output Pseudo-Random Functions are used in IKEv2 and > its extensions. > > The IETF datatracker status page for this Internet-Draft is: > https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-prf-plus/ > > There is also an HTMLized version available at: > https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-ikev2-prf-plus-02 > > A diff from the previous version is available at: > https://author-tools.ietf.org/iddiff?url2=draft-ietf-ipsecme-ikev2-prf-plus-02 > > Internet-Drafts are also available by rsync at: > rsync.ietf.org::internet-drafts > > > _______________________________________________ > IPsec mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ IPsec mailing list -- [email protected] To unsubscribe send an email to [email protected]
