Questions tagged [hkdf]
HKDF is a key derivation function specified in RFC5869.
118
questions
11
votes
1
answer
5k
views
PBKDF vs HKDF for pretty long key
I'm developing a messenger application with encrypted chats.
In the first version of the app I've used PBKDF2 (10000 iterations, SHA1, random salt) to extend a short user password and generate keys ...
- 113
11
votes
4
answers
2k
views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST states ...
11
votes
1
answer
689
views
Can someone clarify two things about the HKDF by Krawczyk?
I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
- 519
8
votes
2
answers
846
views
Do you really need a KDF when you have a PRF?
My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo ...
- 1,535
7
votes
1
answer
3k
views
Multiple AES Key Derivation from a master key
I need cryptography advice regarding this issue.
Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
7
votes
1
answer
4k
views
How is HKDF-Expand better than a simple hash?
Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say:
The second stage "expands" the pseudorandom key to the desired
length......
- 2,005
7
votes
1
answer
2k
views
Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?
I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed:
...
- 500
7
votes
1
answer
3k
views
What information to include is the 'info' input for HKDF?
The RFC states the following:
3.2. The 'info' Input to HKDF
While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main objective is to ...
- 3,965
7
votes
2
answers
3k
views
Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?
I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
- 173
6
votes
1
answer
1k
views
Computing IV for CBC from PBKDF2 + HKDF
Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2?
My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
- 669
6
votes
1
answer
681
views
repeated use of HKDF-extract on the same PRK
Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand.
Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple ...
- 225
6
votes
1
answer
2k
views
Why derive keys from a master key instead of generating random keys?
I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF).
What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
- 237
6
votes
1
answer
915
views
HKDF randomness extraction - salt or no salt?
According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction.
This question is solely about the necessity of a salt for the purposes of randomness ...
- 4,732
6
votes
1
answer
631
views
multiple keys via HKDF - whats better, one or two applications of HKDF-extract
Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256.
Which alternative ...
- 225
5
votes
1
answer
1k
views
Choosing between simple Hash and HKDF to derive the second key used for MAC
I have an encrypt function that takes a single encryption key and encrypts data but also incorporates an HMAC. So I need to derive a second key from the encryption key to use it for HMAC.
You ...
- 517
5
votes
1
answer
1k
views
Faster alternative to HKDF
HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
- 195
5
votes
1
answer
772
views
Key collision in scrypt and hkdf
I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
- 53
4
votes
1
answer
1k
views
Some Questions about the Veracrypt hash functions
Veracrypt has always been my favourite encryption tool since it came out .
But still there are some things about the tool I don't understand .
Why is there the possibility to use sha256 or sha512 .
...
- 4,455
4
votes
1
answer
401
views
Negating the risk of a random 64-bit nonce
Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
- 3,965
4
votes
1
answer
825
views
Applications in which you should/shouldn't use a salt with HKDF
rfc5869 has the following to say about the use or lack thereof of salts with HKDF:
HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
4
votes
1
answer
574
views
KDF vs Stream Cipher
I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead.
It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or ...
- 1,535
4
votes
1
answer
1k
views
SHA512 vs HKDF key expansion
I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value.
From this 128-bit seed, we run SHA512 to derive a ...
- 178
4
votes
1
answer
4k
views
Clarification needed in TLS 1.2 key derivation process
Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here:
To generate the key material, compute
...
- 503
4
votes
1
answer
2k
views
Generating keys with HKDF from Diffie Hellman agreement
In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand ...
- 43
4
votes
0
answers
41
views
What is the impact of leaving a salt used in HKDF open to attacker control? [duplicate]
RFC 5869 for HKDF says "an application needs to make sure that salt values are not chosen or manipulated by an attacker".1 Soatok also discusses some nuances in choosing salts for HKDF.2 ...
3
votes
2
answers
1k
views
How long to wait to feed hashing using SHA 256?
I have a source which generates secrets at $8-10 bits $ per second. I need to use this secret to feed another generator every second. I am wondering how long should I wait while I am concatenating 8 ...
- 195
3
votes
1
answer
332
views
Is the output of HKDF uniformly distributed, if my input is not?
I have done some research on HKDF but I am still not sure about the security properties in different scenarios.
Which properties are fullfilled, when IKM and the salt are random and secret, but not ...
- 308
3
votes
2
answers
488
views
How many different keys can be derived with HKDF before two outputs are identical?
How many different keys can be derived with HKDF before two outputs are identical?
This question is about collision resistance, not about generating different keys with different parameters (eg. ...
- 31
3
votes
1
answer
132
views
What key is used to encrypt the certificate and certificate verify message in TLS1.3?
Which key is used to encrypt certificate and certificate verify message in TLS1.3?
I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
3
votes
2
answers
1k
views
Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme
RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is:
derivation of ...
- 450
3
votes
1
answer
2k
views
The number of keys generated in TLS 1.2?
In section 6.3. Key Calculation in the standard documentation here, I see the following:
The master secret is expanded into a sequence of secure bytes, which
is then split to a client write MAC key, ...
- 503
3
votes
1
answer
1k
views
How to calculate entropy of a combined key
I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys $X$...
- 1,448
3
votes
1
answer
2k
views
HKDF: ikm, salt and info values
As indicated at
Key generation for AES-GCM-256 file encryption
I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
- 71
3
votes
1
answer
1k
views
What is the difference between KDFs for key derivation vs password stretching?
This was mentioned in the comments to another question:
To clarify: This is about key-stretching KDFs. Not the kind for
diversifying keys (eg. HKDF)
and
There are two kinds of KDF, the slow, ...
- 4,913
3
votes
1
answer
222
views
In TLS 1.3, is the first Derived Secret always a constant value (in non-PSK handshakes)?
RFC 5869 Defines HKDF-Extract in section 2.2 as:
HKDF-Extract(salt, IKM) -> PRK
TLS 1.3 RFC 8446 defines the first part of the Key Schedule like this:
...
- 983
3
votes
2
answers
810
views
3
votes
1
answer
2k
views
HKDF: Difference between salt and info
I want to do generate individual AES keys for a number of smart cards, based on a random master key (key diversification) and the serial number of the card.
According to the answers to this question ...
- 173
3
votes
2
answers
1k
views
Doing RSA-KEM with RSA-OAEP
I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
- 133
3
votes
1
answer
734
views
Using KDF output for password validation
I am currently revising an AES data format. I would like to determine whether a provided password/key is incorrect. Previously this was done by validating the HMAC, but this makes it impossible to ...
- 669
3
votes
1
answer
55
views
It is correct to concatenate HKDF expand stages?
I want to derive session keys for many clients from a Master Key. Suppose I derive a key for the client $n$ in the following way:
master_key = HKDF-extract(salt, IKM)
key_client_n = HKDF-expand(...
3
votes
1
answer
397
views
Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?
I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication.
The ...
- 591
3
votes
2
answers
2k
views
Where can I find official test vectors for NIST SP 800-56C r1 Single Step KDF
NIST 800-56Cr1 describes a single and two (extract-expand) step KDF designed for use in key agreement routines. NIST declares that HKDF (RFC5869) is a version of the two-step variation so test vectors ...
- 251
3
votes
1
answer
4k
views
KDF based on HMAC-SHA-256
Is KDF based on HMAC-SHA-256(Hashed Message Authentication Code, Secure Hash Algorithm) algorithm a suitable option to generate symmetric key from the secret key?
What is the basic funda, behind ...
- 301
3
votes
1
answer
120
views
Is HKDF one-way, namely given `Ko` it's hard to guess `Ki`?
For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the ...
- 326
3
votes
0
answers
133
views
Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?
NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
- 43
3
votes
0
answers
164
views
Orignal Krawczyk's HKDF vs latest NIST SP800-56C
I've noticed that the original HKDF in rfc5869 defines a feedback loop. So the pseudo-code is something like:
...
- 131
3
votes
0
answers
90
views
Combining multiple hash functions for HKDF
I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
user56697
2
votes
2
answers
988
views
Wrong Test Vector for HKDF with HMAC-SHA256 [closed]
I have implemented HKDF by myself and it seems to work good. I managed to replicate all the test vectors listed here but... except this one:
...
- 29
2
votes
1
answer
420
views
Security of HKDF when part of output is exposed
There is a system in which Alice and Bob need to establish a secure communication channel. Their conversation happens via a "public" server whose only purpose is to rely messages between users. This ...
- 41
2
votes
1
answer
842
views
Key derivation for AES-GCM using HKDF?
I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
- 21