Given a key $K$ (the key is fixed) and a nonce $N$ (changes from one message to another)

Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for encryption

Can we reach the IND-CPA security level for our encryption ?

  • $\begingroup$ I assume you mean obtaining an ephemeral key $k_N=$KDF($K | N$)? $\endgroup$
    – rath
    Feb 28 '14 at 21:52
  • $\begingroup$ What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ... $\endgroup$
    – K.G.
    Feb 28 '14 at 22:35
  • $\begingroup$ @K.G: Symmetric encryption. $\endgroup$
    – zof
    Feb 28 '14 at 22:45
  • $\begingroup$ If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs? $\endgroup$
    – K.G.
    Mar 1 '14 at 18:00
  • $\begingroup$ I am using a secure KDF to randomize the outputs from one message to another. The derived key Kn=KDF(k|n) is then used in OTP namely C = Kn Xor M . $\endgroup$
    – zof
    Mar 1 '14 at 18:26

Yes, you can.

Your construction $C=P\oplus KDF(K||N)$ is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning $E_K(M)=K\oplus M$), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is proven to be IND-CPA secure.

For practical purposes, as there are better solutions, which already provide higher security levels (IND-CCA2).
I strongly recommend you not to use AES-CTR or "KDF-CTR" but rather use AES-GCM, which provides you with full authentication at high speeds with constant-size tags.

  • $\begingroup$ the claim that the construction is IND-CPA can be justified by this answer. $\endgroup$
    – SEJPM
    Jul 9 '15 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.