Timeline for Should the cSHAKE customization string ever be attacker-controlled?
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 28, 2022 at 12:24 | vote | accept | Neil Madden | ||
| Nov 28, 2022 at 12:24 | answer | added | Neil Madden | timeline score: 1 | |
| Oct 21, 2022 at 17:29 | comment | added | kelalaka | Yes, that's it. You may write an answer to your question if you want ( with a little more details) | |
| Oct 21, 2022 at 10:39 | comment | added | Neil Madden | Hmm, yes I think you’re right. I had taken the comments in the HKDF paper as somehow related to the construction, but I see now that it’s a completely generic attack. Essentially if the salt is used for domain separation of two independent random oracles then if attacker-controlled then they can become dependent and thus insecure. | |
| Oct 20, 2022 at 16:27 | comment | added | kelalaka | Well, same will happen, the attacker can for to resuse a key that can be problematic especially on system that use sequential IV/nonce for encryption... | |
| Oct 20, 2022 at 15:03 | comment | added | Neil Madden | Well, using a XOF for key derivation is an obvious application, so I expect people will do it. | |
| Oct 20, 2022 at 13:58 | comment | added | kelalaka | The reason is clear; NIST doesn't define the use case. Do you want to replace it with HKDF? | |
| Oct 20, 2022 at 13:33 | history | asked | Neil Madden | CC BY-SA 4.0 |