Re: Subsession keys (Re: KINK issue list)

On Mon, 2005-01-31 at 19:43, Michael Thomas wrote:

> I'm hopelessly behind here, but I don't think I saw
> a response to this... why should they be taken into
> account? We're already mixing in entropy from the kdc
> and the ipsec peers. What is more entropy in the form
> of subsession keys buying us? Or am I missing the point?

the kerberos session key tends to be pretty long-lived and will be the same
from authentication to authentication between the same set of peers until
the ticket expires.  subsession keys are different every time.  it's low cost
and gets cryptographers off your back.

but it's not really all that different from a per-exchange nonce.

							- Bill