3
$\begingroup$

I have done some research on HKDF but I am still not sure about the security properties in different scenarios.

Which properties are fullfilled, when IKM and the salt are random and secret, but not uniformly random? Are the output keys uniformly random?

Which guarantees does HKDF give, if (a.) IKM or (b.) salt got leaked?

Is it also uniformly random, if no salt is provided at all?

Furthermore, is there any paper that clearly provides anwers to this question?

Thank you in advance!!

$\endgroup$
1
  • 2
    $\begingroup$ The OKM should be uniformly random regardless of whether you use a salt or not, but using any salt, especially random but even non-random, does improve the randomness extraction. Using a secret salt obviously improves the security as well because it's essentially like a pepper in password hashing or a pre-shared key. The best paper is probably the HKDF paper. I still haven't read it in full, so I may be missing something. I know the paper is somewhat different to the RFC regarding salt reuse, and the salt must not be attacker controlled. $\endgroup$ Apr 4, 2023 at 11:33

1 Answer 1

6
$\begingroup$

All the answers can be found in the original paper: "Cryptographic Extraction and Key Derivation: The HKDF Scheme" which is generally available.

Which properties are fullfilled, when IKM and the salt are random and secret, but not uniformly random? Are the output keys uniformly random?

They should be close to uniformly random yes, as the output of SHA-X is supposed to be uniformly random, assuming that the input isn't chosen deliberately.

The salt is generally not considered to be secret, although it can be.

Which guarantees does HKDF give, if (a.) IKM or (b.) salt got leaked?

If you leak both then you'd leak the output as well of course. As indicated, the salt is usually considered public. If you leak the IKM then the algorithm is deterministic, given a known salt, so an adversary can calculate the OKM.

Is it also uniformly random, if no salt is provided at all?

Again, unless the IKM is deliberately taken from a set known to produce specific results given a salt. The salt does make sure that domain separation takes place.

Furthermore, is there any paper that clearly provides answers to this question?

We can take this text from the HKDF paper:

Informally, a randomness extractor is a family of functions indexed by a public, i.e., nonsecret, parameter (which we refer to as "salt") with the property that on any input distribution with sufficiently high entropy, if one chooses a salt value at random (and independently of the source distribution) the output of the extractor is statistically close to uniform (see below for a formal definition). Moreover, this statistical closeness holds even if conditioned on the salt value.

$\endgroup$
2
  • $\begingroup$ Thank you for your helpful answer! "If you leak the IKM then the algorithm is deterministic, given a known salt, so an adversary can calculate the OKM." Let's say we have kept our salt secret and had it chosen randomly. What is the level of security the salt is protected with if an attacker has access to the output? $\endgroup$ Apr 4, 2023 at 13:52
  • 2
    $\begingroup$ Everything is behind HMAC which is a one-way function, so.... $\endgroup$
    – Maarten Bodewes
    Apr 4, 2023 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.