Why the output length of a KDF should be the same as the underlying OWF?

Question

Quote:

The chosen output length of the key derivation function SHOULD be the same as the length of the underlying one-way function output.

Could someone please help explain the benefits and concerns?

Answer 1

It would be a benefit for badly defined PBKDF's such as PBKDF2. PBKDF2 re-iterates all the iterations if you ask more than the output of the one-way function. This requires the server to perform additional calculations. The attacker however might be able to validate that a guessed password is correct without going through the same number of iterations.

This would for instance be the case if you split the output into a 256 bit key and 128 bit IV when using PBKDF2 - SHA-256 - in that order. The key would be calculated first, then the entire work of hashing is repeated for the IV. But an attacker would only need the first 256 bits to confirm a guess.

---

Some older KBKDF's and PBKDF's such as KDF1/2 and PBKDF1 also simply do not allow for outputting more than the output size of the one-way function.

---

Newer KDF's such as HKDF (a key based KDF or KBKDF) and Argon2 (a password based KDF or PBKDF) have been specifically designed to allow for more output than the one-way function. It should however be remembered that retrieving a 256 bit key from a function that can only provide 160 bits of security will not give you 256 bits security.

This might be the main reason for the given statement.

---

That the output size needs to be precisely the output size of the one-way function is, in my opinion, hogwash. It is perfectly reasonable to ask 512 bits of output and split it into two times 256 bits, while the one-way function only provides 256 bits of security. It is nicer to use two labels and perform a KBKDF twice, but that's not necessarily more secure.

Besides that, it is certainly completely valid to ask for fewer bytes than the one-way function provides.

---

Commonly the output size is a configuration parameter for the KDF. But you might want to consider to use the most up to date KBKDF or PBKDF if you ask for more bits than the one-way function provides. As long as you don't fool yourself with regards to the key strength provided by the KDF, you should be perfectly safe (at least in theory: specification / implementation failures and catastrophic breaks of KDF's are not covered by this insurance).