# Tag Info

1

Key stretching is only used to make small-entropy keys less vulnerable to brute force attacks. If it is (nearly) impossible to break the original key, than there's little sense in using a iteration count of more than 1. If the input to the function is as big (in sense of entropy in bit) as the output, then an attacker could just attack the algorithm which ...

3

Yes, the output should have an entropy of 512 bit (or slightly less). Using it as a key is a good idea. If you want to generate more than 512 bits of key material out of the 512 bit you need to use a Key Derivation Function (KDF). You do not need to stretch the key, because it is no password and has a high amount of entropy - enough to make any brute force ...

3

Simple solution (with symmetric encryption): Assign each device an ID (probably already present) Store a master key on the server Use a KDF on the master key and the device ID to generate the key for the device. Then you only need the device ID on the device, and the server can re-create that key as required with the master key and the device ID. Of course ...

2

Well PBKDF is for deriving keys from passwords, you don't need it if your master keys are already safe, just use something like HKDF. (faster) ECDH and DH are certainly the most secure options you have for negotiating session keys. Of course, as you do have a pre-shared master secret you have some interesting new options. Your usage of the HMAC sounds ...

2

PBKDF2 is an acronym for Password Based Key Derivation Function, #2. As you already have a key you need a Key Based Key Derivation Function or KBKDF instead. Currently the most up to date one is probably HKDF, which was - very quickly - also recognized by NIST. There are other KDF's such as KDF1 and KDF2 which are easier to construct (not many libraries ...

-1

A KDF takes as input a good short random looking password which it maybe easily human saved but actually is not uniformly distributed. An attacker may have some partial knowledge of the password. The output of the KDF is a cryptographically secure key, meaning that it is indistinguishable from a random looking bit-string. Following the Real-Or-Random game ...

-1

Probably the only thing they need to achieve is Pseudo-Randomness, defined in [GGM1986, §3.1]. KDF does not create more entropy than you gave it, but it avoid weaknesses in your cryptosystem due to patterns if the same key is used repeatedly in several rounds.

1

Using simply a hash function is not strong enough, even if the key is not stored. We the users tend to choose very crappy passwords, such as "1234" or "password". If you only use a hash function for generating the key, then there are a lot of chances that the generated keys are SHA256("1234") or SHA256("password"). That is, this method is very vulnerable to ...

1

Any standard key derivation function should do. There are, in general terms, two kinds of KDFs: those that are meant for deriving keys from (potentially) low-entropy passwords, and are thus designed to be deliberately slow (key stretching), and those that are meant for deriving keys from a high-entropy master key / secret, and so can be made much faster. ...

1

KDFs can be used for both: key update and re-keying. As a KDF is usually a Function like this: $KDF(Secret,DerivationParams)$, you can use it to derive keys from old keys (key-update) but you can also use it for re-keying as nothing prevents you from setting a new secret (by the means of the KDF). As there are some KDF that look like this: ...

1

If I'm reading your specs correctly, you do this: $IV||VAL||K_E||K_A=KDF(PBKDF(PW,Salt,Iterations))$. (Order doesn't matter here) As far as I know this is common practice and shouldn't pose any security threats, as the IV is in fact unpredictable as it needs to be. If I may I'd suggest you using EAX, CCM GCM mode if available, as this is easier than using ...

1

Key stretching usually means using a Password-Based Key Derivation Function (PBKDF), these are designed to be more resource intense than standard hashing, which is designed to be as fast as possible. A salt is used to prevent that two derived keys are differentely so that you'd need to brute-force each password independentely. Usually you derive a key from ...

Top 50 recent answers are included