0
$\begingroup$

Let's consider PRNG which is updating its state by using some cryptographically secure hash function. So it takes some input, returns output and this output is a new input. And so on.

Of course there is a risk that such PRNG would fall into short cycle. But it can be resolved by combining the state with counter or Weyl sequence - then we can be sure it will achieve full period (the same as period of underlying Weyl sequence). According to proof in this paper:

https://arxiv.org/abs/1704.00358

This could quarantee also uniformity. Is this a good way to build bactracking resistant PRNG? Are there some dangers I do not see?

$\endgroup$
4
  • $\begingroup$ As mentioned in a comment in the other question, it seems like that you are trying to build your own (Key Based) Key Derivation Function or (KB)KDF. Those are usually build upon a cryptographic hash. HKDF is currently all the rage, but there are simpler variants that use a counter like KDF1 and KDF2. HKDF-Extract uses HMAC internally, which in turn is based on a cryptographic hash. $\endgroup$
    – Maarten Bodewes
    yesterday
  • $\begingroup$ Yes, it looks like my idea is the same as KDF. But if for every key we use random salt and non-invertible hash function, why in case of PBKDF2 NIST recommends a minimum iteration count of 10,000? After all, even if the input to the hash function was not random, the output will be - that's how the secure hash functions we use work. Isn't it enough to hash it just once? According to that - this is the problem with my design above - I assumed only one iteration for generating next secure, bactracking resistant value. But NIST recommends 10,000. $\endgroup$
    – Tom
    yesterday
  • $\begingroup$ Ok, I think I know why we use so many iterations. It looks like in case of KDF we assume that sources are semi-secret or may be compromised to some degree. This is not the same as hashing some value about which we know nothing. But if we feed that PRNG without compromise seed in any way it could returns bactracking resistant values, since first value. $\endgroup$
    – Tom
    yesterday
  • 1
    $\begingroup$ Yes, that's the difference between a Password Based KDF or PBKDF and a KBKDF as I've described. PBKDF2 is defined in PKCS#5: Password Based Encryption (PBE). A KBKDF such as HKDF doesn't need the iterations as the input is basically as secure as a secret key - it may still use a salt for additional security though. $\endgroup$
    – Maarten Bodewes
    yesterday

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.