0
$\begingroup$

i am new to cryptography , i am using article https://medium.com/asecuritysite-when-bob-met-alice/hmac-and-hkdf-df4e194752d1 for reference , while using salt with hkdf to derive multiple keys from a single key for encrypt then mac scheme is it safe if i hard code the random salt value within my program .

i will use password based key derivation to get 32 byte key , i will then use hkdf with salt to derive key for aes encryption and another key for HMAC. Since salt for hkdf shouldn't be transmitted across network ( in that case it will be modified by attacker ), is it secure to hardcode a random salt within my application

$\endgroup$
2
  • $\begingroup$ If the salt is modified, the correct keys won't be derived, meaning the authenticated encryption will fail, so it's not necessarily true that the salt shouldn't be transmitted across a network. $\endgroup$ Jul 26, 2022 at 21:24
  • 1
    $\begingroup$ @samuel-lucas6 In page 26 of the HKDF paper eprint.iacr.org/2010/264.pdf, there is an example of message recovery from a signature on the shared secret. In that scenario, and without salt for domain separation, that would leak all HKDF-derived keys. Thus, if the salt is transmitted in such a way that it is malleable and relied upon by the recipient, an attacker can trick the recipient into using an empty (or different) salt, and thus tricked into encrypting data with compromised derived keys. I agree, though, that with a well-thought-through protocol, this would not be an issue. $\endgroup$
    – knaccc
    Jul 27, 2022 at 7:54

1 Answer 1

3
$\begingroup$

If a salt is being used for domain separation, it does not need to be transmitted, and you would not want the recipient to be tricked into using the wrong salt and thus tricked into deriving keys for the wrong domain.

The salt should be part of your protocol and therefore can be hardcoded into your application. The salt does not need to be random - it only needs to be unique to the particular domain for which you are deriving keys using HKDF.

$\endgroup$
3
  • $\begingroup$ I would argue the salt should be random if you're going to bother with one. Otherwise, I agree. However, I think this answer should discuss the importance of the info parameter. That's where randomness should be introduced if that's required. $\endgroup$ Jul 26, 2022 at 21:31
  • 1
    $\begingroup$ Randomness goes in the info parameter. Salt doesn't have to be random, and it can make sense for it to be a human readable domain separation string. That makes it easy to verify that you're deriving the right key for the purpose. $\endgroup$ Jul 27, 2022 at 1:59
  • 1
    $\begingroup$ @SAIPeregrinus Exactly, except I'd say it's favourable to have the context information in the info still so it's unique to each key. Something like BLAKE3 is so much nicer for key derivation. It's unfortunate there's no salt though. $\endgroup$ Jul 27, 2022 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.