# IND-CPA Security

Given a key $K$ (the key is fixed) and a nonce $N$ (changes from one message to another)

Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for encryption

Can we reach the IND-CPA security level for our encryption ?

-
I assume you mean obtaining an ephemeral key $k_N=$KDF($K | N$)? – rath Feb 28 '14 at 21:52
@rath Yes...... – zof Feb 28 '14 at 21:53
What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ... – K.G. Feb 28 '14 at 22:35
@K.G: Symmetric encryption. – zof Feb 28 '14 at 22:45
If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs? – K.G. Mar 1 '14 at 18:00

Your construction $C=P\oplus KDF(K||N)$ is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning $E_K(M)=K\oplus M$), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is proven to be IND-CPA secure.