# Tag Info

-1

A KDF takes as input a good short random looking password which it maybe easily human saved but actually is not uniformly distributed. An attacker may have some partial knowledge of the password. The output of the KDF is a cryptographically secure key, meaning that it is indistinguishable from a random looking bit-string. Following the Real-Or-Random game ...

-1

Probably the only thing they need to achieve is Pseudo-Randomness, defined in [GGM1986, §3.1]. KDF does not create more entropy than you gave it, but it avoid weaknesses in your cryptosystem due to patterns if the same key is used repeatedly in several rounds.

1

Using simply a hash function is not strong enough, even if the key is not stored. We the users tend to choose very crappy passwords, such as "1234" or "password". If you only use a hash function for generating the key, then there are a lot of chances that the generated keys are SHA256("1234") or SHA256("password"). That is, this method is very vulnerable to ...

1

Any standard key derivation function should do. There are, in general terms, two kinds of KDFs: those that are meant for deriving keys from (potentially) low-entropy passwords, and are thus designed to be deliberately slow (key stretching), and those that are meant for deriving keys from a high-entropy master key / secret, and so can be made much faster. ...

1

KDFs can be used for both: key update and re-keying. As a KDF is usually a Function like this: $KDF(Secret,DerivationParams)$, you can use it to derive keys from old keys (key-update) but you can also use it for re-keying as nothing prevents you from setting a new secret (by the means of the KDF). As there are some KDF that look like this: ...

1

If I'm reading your specs correctly, you do this: $IV||VAL||K_E||K_A=KDF(PBKDF(PW,Salt,Iterations))$. (Order doesn't matter here) As far as I know this is common practice and shouldn't pose any security threats, as the IV is in fact unpredictable as it needs to be. If I may I'd suggest you using EAX, CCM GCM mode if available, as this is easier than using ...

1

Key stretching usually means using a Password-Based Key Derivation Function (PBKDF), these are designed to be more resource intense than standard hashing, which is designed to be as fast as possible. A salt is used to prevent that two derived keys are differentely so that you'd need to brute-force each password independentely. Usually you derive a key from ...

1

Yes, there's an issue: you're adding needless complexity, which gives you absolutely no benefit. The whole point of a PBKDF is to be slow; passwords are low-entropy, and the only way to mitigate brute-force is to make it take time to compute hashes. It can't take too long to log in, so you have to balance "fast for a user" and "slow for an attacker." ...

Top 50 recent answers are included