TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key
SK is encrypted with the truncated hash of the private key:
Htrunc(X) is the result of
SHA256(SHA256(X)), truncated to 16 bytes.
The TAHOE-LAFS paper states:
This somewhat unusual arrangement means that the RSA signing key is encrypted with the truncation of the secure hash of itself. This is an instance key-dependent encryption, which is not as well-studied as we would like. However, we think that it would be surprising if there were a weakness in this construction which did not imply a weakness in the underlying standard primitives – RSA, AES-128, and SHA256.
What are the practical consequences of the use of this construction? Is the paper right in saying that if the underlying primitives are secure, this scheme should be secure as well?