Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Given a key $K$ (the key is fixed) and a nonce $N$ (changes from one message to another)

Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for encryption

Can we reach the IND-CPA security level for our encryption ?

share|improve this question
I assume you mean obtaining an ephemeral key $k_N=$KDF($K | N$)? – rath Feb 28 '14 at 21:52
@rath Yes...... – zof Feb 28 '14 at 21:53
What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ... – K.G. Feb 28 '14 at 22:35
@K.G: Symmetric encryption. – zof Feb 28 '14 at 22:45
If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs? – K.G. Mar 1 '14 at 18:00

1 Answer 1

Yes, you can.

Your construction $C=P\oplus KDF(K||N)$ is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning $E_K(M)=K\oplus M$), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is proven to be IND-CPA secure.

For practical purposes, as there are better solutions, which already provide higher security levels (IND-CCA2).
I strongly recommend you not to use AES-CTR or "KDF-CTR" but rather use AES-GCM, which provides you with full authentication at high speeds with constant-size tags.

share|improve this answer
the claim that the construction is IND-CPA can be justified by this answer. – SEJPM Jul 9 at 20:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.