1
$\begingroup$

I am using a PQ-KEM to get a 32 byte shared secret. I want to derive 2 keys , 1 for encryption of message using AES-CTR and another for HMAC-512. can I safely ignore salt and info parameter in hkdf-sha512 as they are marked optional?

I want to skip salt parameter because in https://datatracker.ietf.org/doc/html/rfc5869#section-3.4 it is given attacker must not manipulate salt parameter. in my application salt for hkdf , info parameter will be sent along with encrypted message with HMAC, however in recipient side before verification of HMAC , the salt and info values sent along with encrypted message has to be used to derive keys using hkdf to derive key to verify HMAC , only then i could authenticate salt , info and ciphertext. I guess this will make my crypto insecure am I correct?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

You only need to use a salt if you need domain separation or randomness extraction (as you can see from the comments in the randomness extraction answer, it is questionable as to whether a salt is actually even needed for randomness extraction).

The info parameter will contain strings as defined in your protocol that will allow different keys to be derived from the same initial keying material at the HKDF-Expand step. Therefore, since the choice of info parameter values used to generate each key will be defined in your protocol, you should not be transmitting them.

Improve this answer
$\endgroup$
10
  • $\begingroup$ a small doubt since i am deriving 2 keys from a single shared secret do i need domain separation in hkdf , since each key is used for different purpose. $\endgroup$
    – vladmir illusinov
    Commented Jul 24, 2022 at 15:40
  • 1
    $\begingroup$ @vladmirillusinov To answer, that would require full knowledge of your protocol and whether you were using that same shared secret elsewhere. To be safe, all you have to do is define a unique salt in your protocol. The salt would be exactly the same each time your protocol is used. The salt would be the same for generating each key, but the info string would be different for each key. $\endgroup$
    – knaccc
    Commented Jul 24, 2022 at 16:14
  • $\begingroup$ will it be a problem if reciever gets encrypted message but salt gets modified by attacker in senario i mentioned in question as given here datatracker.ietf.org/doc/html/rfc5869#section-3.4 $\endgroup$
    – vladmir illusinov
    Commented Jul 25, 2022 at 6:17
  • $\begingroup$ @vladmirillusinov If the salt is defined as part of your protocol, then you should not be sending the salt. Therefore, the attacker can't modify the salt and give the receiver a different salt. You probably don't need domain separation depending on how your PQ-KEM works and if you're not using the shared secret for any other purpose, which means the salt doesn't matter anyway. It's not a problem if the salt is modified unless the shared secret is being used in other contexts and an attacker can trick someone into using a salt to derive keys from your shared secret for use in a different domain $\endgroup$
    – knaccc
    Commented Jul 25, 2022 at 8:32
  • $\begingroup$ I am actually creating new protocol from scratch , so salt is not defined as part of protocol. So attacker can easily modify salt. I will use shared secret only to derive key for encryption and key for HMAC ,i wont be using it for any other purpose, i wonder if in this case i need domain separation. $\endgroup$
    – vladmir illusinov
    Commented Jul 25, 2022 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.