Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I try to understand the PACE-Protocol, especially the Key Derivation Function in ECDH on page 33.

Can someone explain me, what the Counter is good for? Often there are iteration counters in KDF - but here are usual Hash-Functions (like SHA-256) are used as KDF. So there is no iteration. Is this something like a message counter so that we create a new Hash for every new message?

share|improve this question

migrated from Jan 29 '14 at 19:07

This question came from our site for professional and enthusiast programmers.

Welcome to crypto, Thomas. Sorry for the detour :) – Maarten Bodewes Jan 30 '14 at 21:40
up vote 1 down vote accepted

The counter is used to distinguish the different (session) keys used in the protocols. A relatively standard KDF is used, KDF2. Note that only a single iteration is needed and that no OtherInfo has been defined, so the specification of KDF2 may look more complex than it is in the PACE protocol. A 32 bit counter is of course overkill for the protocol, but that's just how the counter has been defined.

So you have the counter valued 1, encoded as 00000001 in hexadecimals as input for the encryption key, and a counter valued 2, encoded as 00000002 for the MAC key.

Some of this is explained in the very first sentence of A.2.3, page 33 (the definitions of KDFMAC and KDFENC).

Note that this counter is entirely different from the Send Sequence Counter used within the secure messaging protocol. That counter is either 64 or 128 bits in size.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.