# IND-CPA Security

Given a key $K$ (the key is fixed) and a nonce $N$ (changes from one message to another)

Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for encryption

Can we reach the IND-CPA security level for our encryption ?

• I assume you mean obtaining an ephemeral key $k_N=$KDF($K | N$)? – rath Feb 28 '14 at 21:52
• What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ... – K.G. Feb 28 '14 at 22:35
• @K.G: Symmetric encryption. – zof Feb 28 '14 at 22:45
• If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs? – K.G. Mar 1 '14 at 18:00
• I am using a secure KDF to randomize the outputs from one message to another. The derived key Kn=KDF(k|n) is then used in OTP namely C = Kn Xor M . – zof Mar 1 '14 at 18:26

Yes, you can.

Your construction $C=P\oplus KDF(K||N)$ is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning $E_K(M)=K\oplus M$), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is proven to be IND-CPA secure.

For practical purposes, as there are better solutions, which already provide higher security levels (IND-CCA2).
I strongly recommend you not to use AES-CTR or "KDF-CTR" but rather use AES-GCM, which provides you with full authentication at high speeds with constant-size tags.

• the claim that the construction is IND-CPA can be justified by this answer. – SEJPM Jul 9 '15 at 20:33