0
$\begingroup$

What kinds of properties does a KDF need to have in order to be considered secure? What steps should be taken during analysis to test for flaws?

In particular, I mean a KDF that is going to be used as a one-time pad. If the plaintext is 1 MB, then the KDF will produce a 1 MB key. And xor them together tp produce the ciphertext.

Improve this question
$\endgroup$
3
  • $\begingroup$ Let us continue this discussion in chat. $\endgroup$
    – Wesley Jones
    Nov 16, 2022 at 1:22
  • 1
    $\begingroup$ The question does not use standard terminology. In particular, "used as a one-time pad" should be used to generate the keystream of a stream cipher; "1 MB key" should be 1 MB keystream. Also it's unclear what the function thought starts from: high-entropy key or low-entropy passphrase? Is it given salt assumed unique, otherwise what's the substitute? Overall the questions is a lot like How do we build a stream cipher,, which is under-specified. $\endgroup$
    – fgrieu ♦
    Nov 16, 2022 at 10:17
  • 2
    $\begingroup$ @fgrieu A lot of the necessary context is in the above chat. OP is trying to build a cipher for a class that will be used to send encrypted data over UART on an embedded system, and must be able to withstand cryptanalysis by his classmates for one week. In particular, he is not allowed to simply use an existing design, so HKDF, ChaCha, and any existing XOFs are out of the question. $\endgroup$
    – forest ♦
    Nov 17, 2022 at 0:54

2 Answers 2

Reset to default
2
$\begingroup$

By definition, one-time pad key must be truly random, not derived by function. So if you have 1MB of truly random data, you do not need KDF function to derive key. And if yo do nout have 1MB of truly random data, yout encryption function is not one-time pad.

Improve this answer
$\endgroup$
0
$\begingroup$

I don't know if there's a checklist per se, but below are a couple of elements I can think of. Before that, I'll just reiterate (like state elsewhere) that a KDF doesn't produce a one-time pad. I suppose the goal is to achieve something akin to a stream cipher. Anyway, KDFs... A starting point is what are the assumptions on the initial key material?

  • Uniform random bit string of sufficient length? Then your KDF will probably need to be a secure variable output length pseudo random function. HKDF-Expand can (in theory) generate up to 8160 bytes.
  • Non-uniform but high (min) entropy ? For a good starting, point, thorough discussion and formalization on KDF security is presented in HKDF paper. In short, a KDF is seen as an algorithm taking some initial keying material, some salt; and outputs a key of some length based on some (non necessarily secret) label. For security, it is demanded that the output key looks random even if an attacker is allowed to see output of the KDF over an arbitrary label. In the previous, the same initial keying material and salt are used, but the attacker can't obviously ask the output on the legit label.
  • Low entropy data like a password? Then a good starting point is looking into the state-of-the art in password based KDFs and all the pitfalls to pay attention too.

Designing such things is hard, analyzing them (based on reasonable assumptions) isn't easier. So an additional element for this "checklist" would be, understanding the security guarantees of existing schemes and the requirements of the context where they will be used. From there, we can decide on the best choice for each use case.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.