Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit.

I am using the SRP protocol for authentication (a type of EKE protocol). As a result of this, both parties will calculate the same large integer value and need to hash it into a key they can both use.

I would like to use SHA256 to generate the key, but its output is twice the length required.

Can I just truncate the hash to the lower 128 bits or something?

What is usually done in this case?

share|improve this question
    
I've just seen another poster ask about the RIPEMD hash functions - I believe there is a 128-bit version. Would anyone recommend using this instead of a SHA2 function in this case? :) –  James Oct 13 '11 at 11:48
    
Why not just use a PRNG? –  Chris Smith Oct 13 '11 at 12:54
add comment

2 Answers 2

Short answer: just truncate, it's fine.

Long answer: you want a Key Derivation Function. A KDF turns an arbitrary-sized input (the shared secret obtained from SRP) into a configurable sequence of bytes, which you can split into as many sub-sequences as you need for symmetric cryptography. For instance, SSL/TLS defines a KDF (it calls it "PRF"; see section 5) so that it can extend the "master secret" (the shared secret obtained from whatever key exchange mechanism has been used) into six elements (an encryption key, a MAC key, and an IV, for each tunnel direction).

If you have a "reasonable" hash function such as SHA-256, and your secret data needs an amount of at most the hash output length, then a simple truncation will be an appropriate KDF. (Theoretically, being a good KDF after truncation is not implied by the hash function being appropriately resistant to collisions and preimages, but in practice you will not get any trouble with SHA-256 or SHA-512.)

share|improve this answer
    
Thanks very much :) –  James Oct 13 '11 at 14:32
add comment

You should have a look at PKCS#5 (aka RFC2898). Many frameworks (e.g. .NET) will provide you with the classes to use them (prefer the later, v2, one if available).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.