Given a key $K$ (the key is fixed) and a nonce $N$ (changes from one message to another)

Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for encryption

Can we reach the IND-CPA security level for our encryption ?

  • $\begingroup$ I assume you mean obtaining an ephemeral key $k_N=$KDF($K | N$)? $\endgroup$
    – rath
    Feb 28, 2014 at 21:52
  • $\begingroup$ What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ... $\endgroup$
    – K.G.
    Feb 28, 2014 at 22:35
  • $\begingroup$ @K.G: Symmetric encryption. $\endgroup$
    – zof
    Feb 28, 2014 at 22:45
  • $\begingroup$ If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs? $\endgroup$
    – K.G.
    Mar 1, 2014 at 18:00
  • $\begingroup$ I am using a secure KDF to randomize the outputs from one message to another. The derived key Kn=KDF(k|n) is then used in OTP namely C = Kn Xor M . $\endgroup$
    – zof
    Mar 1, 2014 at 18:26

1 Answer 1


Yes, you can.

Your construction $C=P\oplus KDF(K||N)$ is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning $E_K(M)=K\oplus M$), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is proven to be IND-CPA secure.

For practical purposes, as there are better solutions, which already provide higher security levels (IND-CCA2).
I strongly recommend you not to use AES-CTR or "KDF-CTR" but rather use AES-GCM, which provides you with full authentication at high speeds with constant-size tags.

  • $\begingroup$ the claim that the construction is IND-CPA can be justified by this answer. $\endgroup$
    – SEJPM
    Jul 9, 2015 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.