SP800-56Cr1 KAS KDF doesn't allow valid values for "L"

[EdSmith-Viasat]

UL gets the following error when they try to generate test vectors for the SP800-56Cr1 One-Step KDF: “KAS-KDF-OneStep-Sp800-56Cr1: Provided 'l' value of 256 does not meet the minimum l value of 512 for the function SHA2_D512.". The algorithm in Section 4.1 of SP800-56Cr1 (and SP800-56Cr2) is:

1. If L > 0, then set reps = CEILING(L / H_outputBits); otherwise, output an error indicator and exit this process without performing the remaining actions (i.e., omit steps 2 through 8).
2. If reps > (232 −1), then output an error indicator and exit this process without performing the remaining actions (i.e., omit steps 3 through 8).
3. Initialize a big-endian 4-byte unsigned integer counter as 0x00000000, corresponding to a 32-bit binary representation of the number zero.
4. If counter || Z || FixedInfo is more than max_H_inputBits bits long, then output an error indicator and exit this process without performing any of the remaining actions (i.e., omit steps 5 through 8).
5. Initialize Result(0) as an empty bit string (i.e., the null string).
6. For i = 1 to reps, do the following: 6.1. Increment counter by 1. 6.2. Compute K(i) = H(counter || Z || FixedInfo). 6.3. Set Result(i) = Result(i – 1) ||K(i).
7. Set DerivedKeyingMaterial equal to the leftmost L bits of Result(reps).
8. Output DerivedKeyingMaterial.

We are using a SP800-56Cr1 KDF to derive 256-bit DerivedKeyingMaterial. We’re using a SHA-512 hash as the function “H”, as allowed by Option 1 in Section 4.1. Although the specification limits max_H_inputBits to the output size of the hash function why is the minimum L value limited to 512-bits when using the SHA2_D512 function?

[livebe01]

Hi @EdSmith-Viasat, sorry for the slow reply. The minimum L value shouldn't be limited to 512-bits. We'll look into this. It seems like the proper bound should be minimum 112 bits

[GlennUL]

@livebe01 Is there any update on this issue?

[livebe01]

Working on this now. Apologies on the delay.

[livebe01]

This Fix is now on Demo

[Kritner]

This change is on production in release v1.1.0.20