I'm working on a program that requires multiple key pairs from multiple algorithms to be derived from a single 128-byte master seed. However, I couldn't find an implementation for Falcon512 that allows generating key pairs directly from the seed. Would it be safe if I passed the master seed through an XOF and extended it to the length of the Falcon512 secret key (which is 1281 bytes) and use that to recover the public key from?

  • 1
    $\begingroup$ HKDF is your friend Use $L$ to get the desired key size and info to derive multiple keys. $\endgroup$
    – kelalaka
    Nov 25, 2023 at 14:23

1 Answer 1


A KDF usually has stronger security requirements than a XOF. I've sometimes called a hash a "poor man's KDF" - it is probably secure but it hasn't been explicitly designed to be secure as a KDF, and it doesn't have a well defined input structure for additional input parameters (such as a label or a salt).

There have been some explorations to use SHAKE as a KDF, such as using KMAC("KDF", k, X) and cSHAKE. None of those have been standardized or studied well though, and using HKDF seems more logical in most circumstances.

As for your use case using the seed to derive the public key is only useful if you don't want to store the public key next to the private key for later (secure) distribution of said public key. The use case is limited.

I've heard a lot about storing the seed instead of private keys or key pairs for PQC. That's all fine, but it would be a good idea to then standardize the way of deriving the key pair from those - even though private keys do not have the same compatibility requirements as public keys. But there are certainly use cases where this might become an issue, e.g. when switching programming environment.

  • $\begingroup$ The problem is that the implementation that i use for HKDF(rust ring crate) doesn't allow me to derive a 1281bytes key, can't i derive a 64bytes child seed from the HKDF and pass the child seed through SHAKE512 to extend it to 1281bytes which is needed for Falcon512? $\endgroup$ Nov 26, 2023 at 11:24
  • $\begingroup$ Yes, you can absolutely do this, but I've indicated the drawbacks above. Using a true-to-form KDF initially will at least theoretically make your algorithm a bit more secure. It's really a shame that no SHA-3 KDF has been standardized yet; in principle Keccak is able to perform all the "symmetric" functions in a crypto-system but it seems progress has stalled. I've looked at the Falcon spec again, but it just requires "enough entropy" for $f$ and $g$. They certainly do not explicitly specify how to generate those from a seed, i.e. no deterministic key pair generation is specified. $\endgroup$
    – Maarten Bodewes
    Nov 26, 2023 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.