# Key-dependent encryption in TAHOE-LAFS

TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key SK is encrypted with the truncated hash of the private key:

ENC(Htrunc(SK), SK)


Where Htrunc(X) is the result of SHA256(SHA256(X)), truncated to 16 bytes.

The TAHOE-LAFS paper states:

This somewhat unusual arrangement means that the RSA signing key is encrypted with the truncation of the secure hash of itself. This is an instance key-dependent encryption, which is not as well-studied as we would like. However, we think that it would be surprising if there were a weakness in this construction which did not imply a weakness in the underlying standard primitives – RSA, AES-128, and SHA256.

What are the practical consequences of the use of this construction? Is the paper right in saying that if the underlying primitives are secure, this scheme should be secure as well?

-
What is ENC, specifically? How is it instantiated? – D.W. Apr 3 '14 at 10:52
I'm not sure about TAHOE-LAFS, but for my uses I am considering AES CCM. (Edit: TAHOE-LAFS uses AES-CTR) – user2398029 Apr 3 '14 at 14:08